Pentesting
Write-ups on PortSwigger Web Security Academy and Root-Me challenges — SQL injection, XSS, SSRF, and more. Each post covers the vulnerability theory and a step-by-step walkthrough.
Server-Side Template Injection in Flask (VulHub)
Exploiting SSTI in Flask/Jinja2: from {{7*7}} to RCE via Python MRO object chain.
Cross-Site WebSocket Hijacking in OpenClaw (VulHub)
Exploiting CSWSH vulnerability CVE-2026-25253 in OpenClaw Control UI: stealing auth.token via WebSocket server substitution, CVSS 8.8.
Server-Side Request Forgery (SSRF)
Complete breakdown of SSRF — where to look, types, protocols, filter bypass, cloud metadata, paths to RCE, defenses. Theory, methodology, cheat sheet.
Server-Side Template Injection (SSTI)
Complete SSTI breakdown — detection, engine identification, sandbox escape, per-engine exploitation, blind SSTI, defense. Theory, methodology, cheatsheet.
XML External Entity (XXE)
Complete XXE breakdown — XML entities, DTD, all attack vectors, blind/error-based, bad character bypasses, defense by language. Theory, methodology, cheatsheet.
SQL Injection — File Reading (Root-Me)
Root-Me walkthrough: UNION-based SQL injection, bypassing quote escaping with ASCII hex, and reading server files via LOAD_FILE.
PortSwigger Web Security Academy
PortSwigger lab marathon — catalog by topic and per-day stats.