archive

technical writings

Only actual writeups live here. Projects stay on the homepage where they belong.

FamPay CTF Writeups Six challenge writeups covering access control, Firebase, App Check, native signing, JWT alg:none, mobile reversing, and cloud metadata abuse Jul 7, 2026 01 THE LIBRARY Secret left inside native app code FamPay 02 THE DATABASE Firebase anonymous auth and exposed database path FamPay 03 THE VAULT App Check debug token and trusted app identity FamPay 04 THE ENDPOINT Native request signing and admin-only clearance FamPay 05 THE VAULT DOOR JWT role bypass using alg:none FamPay 06 THE CLOUD Debug webhook SSRF to IMDSv2 and S3 FamPay SantaCloud Intigriti Web Challenge Write-Up From sensitive file exposure to IDOR / Broken Object Level Authorization Jan 1, 2026