August 2026
CryptoCabana Kiosk — Cloud CTF Writeup
CryptoCabana is a kiosk web app that lets visitors "back up" their crypto wallet seed phrase with one click. The objective: find out what the kiosk quietly trusts to reach into Azure storage on its own, and see how far that trust extends.
Ponzi — Race Condition in Daily Reward Claim (difficulty: Medium)
Target app: Ponzi, a fictional crypto-rewards app ("wellness portal, poolside edition") with a daily claim mechanism. Goal: prove the 24-hour cooldown on the daily reward can be bypassed via a race condition and pull the flag from the Whale Vault.
Byte Lotus — Poolside (Boot2Root, Medium)
Medium Boot2Root with a poolside/crypto theme. The box chains five separate vulnerabilities: NoSQL injection for auth bypass, Server-Side Template Injection for RCE, and a misconfigured Node.js Inspector plus group membership for privilege escalation to root.
TryHackMe Resort write-up
Boot2Root via unsafe YAML deserialization (yaml.load RCE) on a Flask jukebox app, a dash-vs-bash reverse-shell pitfall, and privilege escalation from a root password leaked in a process command line.
July 2026
Format String Exploit — GOT Overwrite to win()
Remote pwn challenge with a format string vulnerability instead of a classic buffer overflow. Goal: get a shell via an uncalled win() function, despite modern binary protections (no canary, but NX and CET).
TryPwnMeOne - TheLibrarian (ret2libc)
Remote binary exploitation challenge. Target: thelibrarian, running on MACHINEIP:9008, with matching libc.so.6 and ld-linux-x86-64.so.2 provided alongside the binary.
TryPwnMeOne: Random Memories — Write-up
A PIE ret2win: the binary leaks its own vuln() address (breaking ASLR), a 512-byte read into a 256-byte buffer overflows the stack, and an extra ret gadget fixes alignment before system() — ending in a root shell.
Workflow: finding a binary exploit blind (from zero to shell)
Starting point: you have a binary (and/or an IP:port), no other context. This order takes you systematically from recon to shell.
June 2026
OSINT playbook
Methodology and tooling for passive recon on companies/domains and people, plus a checklist per engagement.
Nmap basics: host discovery and port scanning
Notes on the first scans against Metasploitable: -sn for discovery, -sV for service versions, and when -p- is needed.
Hardware hacking gadgets: Pwnagotchi, Bjorn, Marauder and more
What Pwnagotchi, Bjorn, ESP32 Marauder/Cardputer and similar gadgets (Flipper Zero, WiFi Pineapple, Proxmark3, HackRF etc.) do, how they work, and whether to buy or build them yourself.
Cheatsheet: tool overview
Quick reference for Nmap, Burp Suite, Hashcat, Gobuster/ffuf and Wireshark filters.
Bug bounty playbook
Workflow from recon to report, high-yield vulnerability classes, and how to write a report that doesn't get rejected as a duplicate.