--- title: "Cyber Sekler (@CyberSekler) | Hashnode" description: "Penetration Tester | Ethical Hacker. Read the latest articles by Cyber Sekler on Hashnode." url: "https://hashnode.com/@CyberSekler" --- @CyberSekler # Cyber Sekler @CyberSekler · United Kingdom · Joined September 2023 Penetration Tester | Ethical Hacker ### [Password Reset Poisoning Leading to Account Takeover](https://cybersekler.com/password-reset-poisoning-leading-to-account-takeover?utm_source=hashnode&utm_medium=feed) Overview During a penetration test of a Web Applications API, I discovered a vulnerability in the password reset functionality that allowed an attacker to intercept reset tokens and take over user accounts. By manipulating a user-controllable field i... 2 min read · [cybersekler.com](https://cybersekler.com/password-reset-poisoning-leading-to-account-takeover?utm_source=hashnode&utm_medium=feed) [Jan 16](https://hashnode.com/posts/password-reset-poisoning-leading-to-account-takeover/696a6f62a4452b9b6e82c079) ### [Exposed .git Directory Leading to Source Code Disclosure and Hardcoded Credentials](https://cybersekler.com/git-gone-wrong-application-compromise-via-exposed-git-directory?utm_source=hashnode&utm_medium=feed) During a web application assessment, I discovered an exposed .git directory that allowed me to download the application's entire source code. By extracting and analysing the git objects, I identified hardcoded credentials that granted admin-level acc... 2 min read · [cybersekler.com](https://cybersekler.com/git-gone-wrong-application-compromise-via-exposed-git-directory?utm_source=hashnode&utm_medium=feed) [Dec 16, 2025](https://hashnode.com/posts/git-gone-wrong-application-compromise-via-exposed-git-directory/6691482dc35aa735cf0f7c50) ### [Broken Access Control Leading to Privilege Escalation](https://cybersekler.com/broken-access-control-leading-to-privilege-escalation?utm_source=hashnode&utm_medium=feed) Overview During a web application penetration test, I identified a broken access control issue that allowed a low-privileged user to escalate their privileges to administrator. The issue was easy to identify and had a high impact, as it allowed full ... 2 min read · [cybersekler.com](https://cybersekler.com/broken-access-control-leading-to-privilege-escalation?utm_source=hashnode&utm_medium=feed) [May 20, 2025](https://hashnode.com/posts/broken-access-control-leading-to-privilege-escalation/653bbd0b0fde57c20e901b4a) ### [Unauthenticated SQL Injection Leading to Remote Command Execution in a Web Application](https://cybersekler.com/from-unauthenticated-sql-injection-to-remote-command-execution-rce?utm_source=hashnode&utm_medium=feed) Overview During a black-box web application penetration test, I identified an unauthenticated SQL injection vulnerability that could be escalated to remote command execution. Although SQL injection vulnerabilities are less common today, this finding ... 2 min read · [cybersekler.com](https://cybersekler.com/from-unauthenticated-sql-injection-to-remote-command-execution-rce?utm_source=hashnode&utm_medium=feed) [Nov 16, 2024](https://hashnode.com/posts/from-unauthenticated-sql-injection-to-remote-command-execution-rce/653bbaffa323652241377f4c) ### [Web Application Account Compromise via 2FA Bypass](https://cybersekler.com/2fa-bypass-how-not-to-implement-two-factor-authentication?utm_source=hashnode&utm_medium=feed) Overview During a penetration test of a web application, I identified a flawed two-factor authentication implementation that could be bypassed using brute-force techniques. This finding demonstrates that poorly implemented two-factor authentication (... 2 min read · [cybersekler.com](https://cybersekler.com/2fa-bypass-how-not-to-implement-two-factor-authentication?utm_source=hashnode&utm_medium=feed) [Jul 9, 2024](https://hashnode.com/posts/2fa-bypass-how-not-to-implement-two-factor-authentication/653bc37b346796b54d842107)