Breaking apps, not hearts

Race Condition A Detailed Exploration

Learn about race conditions, their types, exploitation techniques, and mitigation strategies.

How I Tricked the System with Type Confusion and Became a System Admin (Briefly)

A brief story of how a Type Confusion vulnerability allowed privilege escalation in a real-world scenario.

Node.js Arbitrary File Upload to RCE – AppSec Master Challenge Writeup

SpEL Injection Exploit – AppSec Master Challenge Writeup

Pickle RCE: Exfiltrating Secrets via Unsafe Deserialization

Code Review: Exploiting SSTI in Node.js Template Rendering

Flag28Service AIDL Binding Walkthrough (Hextree Lab)

A step-by-step guide to reverse engineering and exploiting an exported Android AIDL-based bound Service from another app.

Hextree Labs - Flag27Service Messenger Vulnerability (Solution)

A short write-up on exploiting an Android Service vulnerability involving Messenger IPC and state management to retrieve a hidden flag.

Exploiting Flag26Service – Android Messenger-Based Service (Hextree CTF)

Path Traversal in File Upload via GraphQL API

A file upload endpoint accepted folder traversal sequences, enabling unauthorized file placement and abuse of signed Google Cloud Storage URLs.

Auth Token Theft via CORS Misconfiguration

A critical CORS misconfiguration allowed stealing authentication tokens by abusing a wildcard-like origin match and Access-Control-Allow-Credentials: true.

Privilege Escalation via Chat Permissions Bypass

A real-world case where UI-level permission controls were not enforced at the API level, allowing message sending and user impersonation.