Blog

• September 23, 2026

  Bypassing Pangolin access rules using URL-encoded path traversal

  • security
  • vulnerability

  Using URL-encoded path separators to bypass Pangolin < v1.21.0's path-based access rules

• May 26, 2026

  Android app WebView hijacking via MITM

  • security
  • bug bounty

  Stealing user logins by hijacking a vulnerable webview implementation in a mobile app

• March 31, 2026

  Finding XSS via indirect prompt injection

  • security
  • bug bounty

  A short writeup of finding a stored XSS vulnerability in an AI powered writing app

• March 5, 2026

  HTB Writeup - Interpreter

  • ctf

  A medium rated Linux machine running Healthcare software

• February 19, 2026

  HTB Writeup - WingData

  • ctf

  An easy rated Linux machine running an FTP webapp

• January 24, 2026

  Hackinghub Writeup - Naughty Or Nice

  • ctf

  A holiday CTF where you have to get NahamSec off the Naughty List

• January 15, 2026

  HTB Writeup - Eighteen

  • ctf

  An easy rated Windows machine involving the BadSuccessor exploit