--- title: "Opara David (@Zalparus) | Hashnode" description: "I develop secured software and also perform actively in cybersecurity researches." url: "https://hashnode.com/@Zalparus" --- @Zalparus # Opara David @Zalparus 路 127.0.0.1 路 Joined August 2023 ### [Unmasking Hidden Backdoors: How I Traced a Webshell Dropper in a PHP App](https://zalparus.hashnode.dev/unmasking-hidden-backdoors-how-i-traced-a-webshell-dropper-in-a-php-app?utm_source=hashnode&utm_medium=feed) Discover how I uncovered a hidden SSI-based webshell dropper planted in a PHP application. Step-by-step investigation. 5 min read 路 [zalparus.hashnode.dev](https://zalparus.hashnode.dev/unmasking-hidden-backdoors-how-i-traced-a-webshell-dropper-in-a-php-app?utm_source=hashnode&utm_medium=feed) [Sep 23, 2025](https://hashnode.com/posts/unmasking-hidden-backdoors-how-i-traced-a-webshell-dropper-in-a-php-app/68d280d6550df4aab871fd22) ### [Tryhackme Smol Challenge ( Medium level CTF)](https://zalparus.hashnode.dev/tryhackme-smol-challenge-medium-level-ctf?utm_source=hashnode&utm_medium=feed) Smol is a vulnerable WordPress application with outdated plugins connected to it. The first step in solving a CTF is to usually read the description thoroughly. In order to have an idea of how to effectively walkthrough. This is the description. Fro... 3 min read 路 [zalparus.hashnode.dev](https://zalparus.hashnode.dev/tryhackme-smol-challenge-medium-level-ctf?utm_source=hashnode&utm_medium=feed) [Sep 20, 2025](https://hashnode.com/posts/tryhackme-smol-challenge-medium-level-ctf/68ceaef2988d00e980f1fb1e) ### [How i was able to exploit a vulnerable payment system.](https://zalparus.hashnode.dev/how-i-was-able-to-exploit-a-vulnerable-payment-system?utm_source=hashnode&utm_medium=feed) Hello hackers and security enthusiasts, we are here again to serve you dinner in a 5-star hotel 馃槉. Hope you enjoy it !!!. LITTLE BIO ABOUT ME I鈥檓 David, a software developer and cybersecurity researcher who specializes in application security. I spe... 2 min read 路 [zalparus.hashnode.dev](https://zalparus.hashnode.dev/how-i-was-able-to-exploit-a-vulnerable-payment-system?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/how-i-was-able-to-exploit-a-vulnerable-payment-system/683ee4f0bb519b1525c21c12) [Jun 3, 2025](https://hashnode.com/posts/how-i-was-able-to-exploit-a-vulnerable-payment-system/683ee4f0bb519b1525c21c12) ### [How i was able to abuse XML-RPC to get Origin IP.](https://zalparus.hashnode.dev/how-i-was-able-to-abuse-xml-rpc-to-get-origin-ip?utm_source=hashnode&utm_medium=feed) What is XML-RPC XML-RPC stands for "XML Remote Procedure Call". It鈥檚 a protocol that allows software running on different operating systems or written in different programming languages to make procedure calls over a network (usually HTTP). How it wo... 2 min read 路 [zalparus.hashnode.dev](https://zalparus.hashnode.dev/how-i-was-able-to-abuse-xml-rpc-to-get-origin-ip?utm_source=hashnode&utm_medium=feed) [May 17, 2025](https://hashnode.com/posts/how-i-was-able-to-abuse-xml-rpc-to-get-origin-ip/68289ec4cf66728de21fb73c) ### [JWT misconfiguration and PII sensitive information leak](https://zalparus.hashnode.dev/jwt-misconfiguration-and-pii-sensitive-information-leak?utm_source=hashnode&utm_medium=feed) Hi guys, Its David again, your favorite software developer and Security Researcher. I am back again with another report for you. Like i promised, i would make sure to be documenting all my bug findings. Had a busy week, so i utilized the weekend to m... 3 min read 路 [zalparus.hashnode.dev](https://zalparus.hashnode.dev/jwt-misconfiguration-and-pii-sensitive-information-leak?utm_source=hashnode&utm_medium=feed) [May 5, 2025](https://hashnode.com/posts/jwt-misconfiguration-and-pii-sensitive-information-leak/68189c18a9a0563082fc289e)