Everything, by year

2025 — 11 posts

• 16 Jun 2025 Race Condition A Detailed Exploration
• 24 Mar 2025 How I Tricked the System with Type Confusion and Became a System Admin (Briefly)
• 3 Aug 2025 Node.js Arbitrary File Upload to RCE – AppSec Master Challenge Writeup
• 31 Jul 2025 SpEL Injection Exploit – AppSec Master Challenge Writeup
• 31 Jul 2025 Pickle RCE: Exfiltrating Secrets via Unsafe Deserialization
• 28 Jul 2025 Code Review: Exploiting SSTI in Node.js Template Rendering
• 15 Jun 2025 Flag28Service AIDL Binding Walkthrough (Hextree Lab)
• 14 Jun 2025 Hextree Labs - Flag27Service Messenger Vulnerability (Solution)
• 9 Jun 2025 Exploiting Flag26Service – Android Messenger-Based Service (Hextree CTF)
• 11 Mar 2025 Path Traversal in File Upload via GraphQL API
• 8 Mar 2025 Auth Token Theft via CORS Misconfiguration

2024 — 1 posts

• 7 Feb 2024 Privilege Escalation via Chat Permissions Bypass