Journal
Writing about Linux, security, and software development.
22 articles
A complete step-by-step walkthrough for the Smol CTF room: exploiting jsmol2wp LFI to leak wp-config, abusing a backdoored Hello Dolly plugin for RCE, cracking WordPress phpass hashes, pivoting through user accounts via SSH keys and passwordless sudo, and cracking encrypted zip archives for root.
An exhaustive technical breakdown of the computer boot sequence, featuring multi-stage architectural flowcharts, POST verification assembly, BIOS interrupts, MBR vs GPT partitioning, 16-bit Real Mode, UEFI architecture, and Secure Boot key hierarchies.
A complete guide to SQL Injection theory followed by individual PortSwigger Security Academy lab walkthroughs, detailing database fingerprinting, schema enumeration, UNION attacks, and string concatenation.
A complete walkthrough for the PyRAT CTF room on TryHackMe: discovering a custom TCP Python socket interpreter, popping an initial reverse shell, enumerating git repository configuration for credentials, and abusing an admin prompt to crack root.
A technical walkthrough of the Break-Me CTF machine covering WordPress parameter pollution, Bash IFS command injection, SUID TOCTOU race conditions, and Python NFKC Unicode normalization jail escapes.
A complete step-by-step writeup for the Mr Robot CTF: port scanning, decoding hidden base64 credentials, uploading a simplified PHP reverse shell, cracking MD5 user hashes, and abusing SUID Nmap interactive mode for root access.
A step-by-step TryHackMe write-up for Beach Box: discovering credentials in HTML comments, exploiting PyYAML unsafe deserialization for RCE, and root privilege escalation via process argument credential reuse.
A 32-bit x86 buffer overflow CTF write-up: analyzing 32-bit stack frames in GDB, calculating 44-byte offset to saved EIP, and packing target win() with struct.pack('<I').
8 of 22 articles