SSunnyAug 26 · 10 min readTryHackMe Broken Access Control Room: Comprehensive Learning Guide & Deep DiveIntroduction I recently completed the Broken Access Control room on TryHackMe as part of my ongoing cybersecurity learning journey. Consistently ranked as the #1 vulnerability in the OWASP Top 10, Brocybersecurity-learning.hashnode.dev
YYogeshwar PeelaAug 4 · 6 min readTryHackMe : Towel on the Sunbed WriteupTL;DR Ponzi Portfolio is a Node.js/Express "staking rewards" web app with a 24-hour cooldown on claiming a reward. The /claim endpoint has a classic check-then-act race condition: it checks whether th1exploitnotes.hashnode.dev
SSunnyJul 23 · 18 min readTryHackMe Burp Suite Repeater Beginner-Friendly Learning GuideIntroduction I recently completed the Burp Suite: Repeater room on TryHackMe as part of my ongoing cybersecurity learning journey. Burp Suite is one of the most widely used tools for web application scybersecurity-learning.hashnode.dev
YYogeshwar PeelaJul 18 · 13 min readFAM CTF: The Library to The Endpoint WriteupExecutive Summary FAM is a mobile CTF challenge distributed as an Android APK (fam-ctf.apk) with four staged flags, each themed around a different layer of the app's Firebase backend: The Library (natexploitnotes.hashnode.dev
YYogeshwar PeelaJul 18 · 4 min readFAM CTF : The Vault Door WriteupSummary NexaVault is a mock internal dashboard app that gates an "Admin Vault" panel behind a role claim in a JWT. The app issues a user-role token on login, stored in the nx_access cookie, and trustsexploitnotes.hashnode.dev
YYogeshwar PeelaJul 17 · 4 min readHackTheBox : WayWitch WriteupSummary The ticket portal generates guest session JWTs client-side, signing them with an HMAC secret (halloween-secret) that's hardcoded directly in the page's JavaScript. Since the server verifies toexploitnotes.hashnode.dev
AAmal PKMay 8 · 4 min readHow to Set Up Burp Suite Proxy on Rooted Android with AlwaysTrustUserCerts (Magisk)Setting up Burp Suite with Android devices or emulators can be annoying, especially on newer Android versions where user-installed certificates are not trusted by many apps by default. There are many blog.amalpk.in
WWiktoria Blomgren StrandbergApr 18 · 27 min readInsecure CAPTCHA in DVWA1 Introduction In this post, the Insecure CAPTCHA vulnerability in the Damn Vulnerable Web Application (DVWA) is described. The objective for attacks on all levels is to bypass the poor CAPTCHA systempentesting-dvwa.hashnode.dev
MMD MUNIF MUBTASHIMOct 17, 2025 · 7 min readWhat is Burp Suite ?Burp Suite is Java based framework designed to serve as a comprehensive solution for conducting web application penetration testing.It captures and enables manipulation of all the HTTP?HTTPS traffic between a browser and a web server. Burp Suite is ...burp-suite.hashnode.dev
TTaji AbdullahJun 6, 2025 · 2 min readFile path traversal, simple caseIntro I first got experience with Burp Suite during TryhackMe’s Advent of Cyber 24 event. Months later I haven’t used it since. I wanted to refresh and learn more so I signed up to Portswigger Web Security Academy to get more hands on experience from...technofiles.hashnode.dev
