archive

technical writings

Only actual writeups live here. Projects stay on the homepage where they belong.

CloudSEK Hiring CTF Writeups Four challenge writeups covering web, OSINT, runtime secrets, vector databases, and exploit chains Jul 13, 2026

Internal Affairs 1 & 2 Virtual-host discovery, PHP source disclosure, and PHAR deserialization CloudSEK Echoes of Runtime Spring Boot Actuator, heap analysis, and credential leakage CloudSEK DevSecOops - Linked Flaws - Rebirth Mobile metadata, GitLab OSINT, Grafana SSRF, and Loki log analysis CloudSEK Total Recall Qdrant enumeration, model fingerprinting, and embedding inversion CloudSEK

FamPay CTF Writeups Six challenge writeups covering access control, Firebase, App Check, native signing, JWT alg:none, mobile reversing, and cloud metadata abuse Jul 7, 2026

01 THE LIBRARY Secret left inside native app code FamPay 02 THE DATABASE Firebase anonymous auth and exposed database path FamPay 03 THE VAULT App Check debug token and trusted app identity FamPay 04 THE ENDPOINT Native request signing and admin-only clearance FamPay 05 THE VAULT DOOR JWT role bypass using alg:none FamPay 06 THE CLOUD Debug webhook SSRF to IMDSv2 and S3 FamPay

SantaCloud Intigriti Web Challenge Write-Up From sensitive file exposure to IDOR / Broken Object Level Authorization Jan 1, 2026