YPYogeshwar Peelainexploitnotes.hashnode.dev·6d ago · 6 min readTryHackMe : Towel on the Sunbed WriteupTL;DR Ponzi Portfolio is a Node.js/Express "staking rewards" web app with a 24-hour cooldown on claiming a reward. The /claim endpoint has a classic check-then-act race condition: it checks whether th10
SSunnyincybersecurity-learning.hashnode.dev·Jul 23 · 18 min readTryHackMe Burp Suite Repeater Beginner-Friendly Learning GuideIntroduction I recently completed the Burp Suite: Repeater room on TryHackMe as part of my ongoing cybersecurity learning journey. Burp Suite is one of the most widely used tools for web application s00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 18 · 13 min readFAM CTF: The Library to The Endpoint WriteupExecutive Summary FAM is a mobile CTF challenge distributed as an Android APK (fam-ctf.apk) with four staged flags, each themed around a different layer of the app's Firebase backend: The Library (nat00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 18 · 4 min readFAM CTF : The Vault Door WriteupSummary NexaVault is a mock internal dashboard app that gates an "Admin Vault" panel behind a role claim in a JWT. The app issues a user-role token on login, stored in the nx_access cookie, and trusts00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 17 · 4 min readHackTheBox : WayWitch WriteupSummary The ticket portal generates guest session JWTs client-side, signing them with an HMAC secret (halloween-secret) that's hardcoded directly in the page's JavaScript. Since the server verifies to00
SESonny Enchillinsonnyenchill.hashnode.dev·Jun 18 · 4 min readThe File Upload That Looked Safe — Until I Changed One Request HeaderThe file upload form had validation. It checked the file type, rejected anything that wasn't an image, and showed a helpful error message when you tried to upload a .php file. The check ran entirely i00
APAmal PKinblog.amalpk.in·May 8 · 4 min readHow to Set Up Burp Suite Proxy on Rooted Android with AlwaysTrustUserCerts (Magisk)Setting up Burp Suite with Android devices or emulators can be annoying, especially on newer Android versions where user-installed certificates are not trusted by many apps by default. There are many 00
WBWiktoria Blomgren Strandberginpentesting-dvwa.hashnode.dev·Apr 18 · 27 min readInsecure CAPTCHA in DVWA1 Introduction In this post, the Insecure CAPTCHA vulnerability in the Damn Vulnerable Web Application (DVWA) is described. The objective for attacks on all levels is to bypass the poor CAPTCHA system00
MMMD MUNIF MUBTASHIMinburp-suite.hashnode.dev·Oct 17, 2025 · 7 min readWhat is Burp Suite ?Burp Suite is Java based framework designed to serve as a comprehensive solution for conducting web application penetration testing.It captures and enables manipulation of all the HTTP?HTTPS traffic between a browser and a web server. Burp Suite is ...00
TATaji Abdullahintechnofiles.hashnode.dev·Jun 6, 2025 · 2 min readFile path traversal, simple caseIntro I first got experience with Burp Suite during TryhackMe’s Advent of Cyber 24 event. Months later I haven’t used it since. I wanted to refresh and learn more so I signed up to Portswigger Web Security Academy to get more hands on experience from...00
