Collection of my thoughts on various topics
❯ 18 of 18 posts
A crypto writeup from HTB Cyber Apocalypse CTF 2026 — recovering a hidden Adler-32 target via checksum composition, then forging a single number whose Adler-32 and CRC-32 both collide with it.
A pwn writeup from HTB Cyber Apocalypse CTF 2026 — chaining single 5-byte relative branches through a two-state RWX-page machine to land a posix_spawn one_gadget with no libc leak.
A reverse engineering writeup from HTB Cyber Apocalypse CTF 2026 — recovering a deterministic anti-analysis XOR key to decode shellcode hidden inside a replication log's timestamp fields.
A first-timer's walkthrough of fuzzing the RESP3 reply parser in go-redis — from a five-second crash to disclosure with Redis's security team and a four-line fix merged into a library with millions of downloads.
BloodHound already holds the answer in the graph — the operator has always been the one reasoning over it. pathhound-mcp is a read-only MCP server that hands that reasoning to the model, grounded in a graph you already collected.
A medium pwn writeup from BlackHat MEA Quals 2025 — abusing scanf into libc's FILE structures to leak libc and pull off a File Stream Oriented Programming (FSOP) attack for a shell.
A medium pwn writeup from CM CTF 2025 — using a negative out-of-bounds index write to overwrite a pointer and redirect execution to the win function.
My review of CyberWarFare Labs' Certified Red Team Analyst (CRTA) exam — my prep, what the assessment demanded, and honest tips for passing it.
My review of INE's eJPT (Junior Penetration Tester) exam — my prep timeline, what the exam covers, and the resources I leaned on to pass.
A crypto writeup from PCC Quals 2024 — breaking an AES-CTR challenge with keystream reuse and a crib-dragging attack to recover the flag.
A pwn writeup from CSAW CTF 2024 — leaking an address through a format-string bug to defeat PIE and ASLR, then redirecting execution to the win function.
A step-by-step guide to deploying the KYPO Cyber Range Platform on OpenStack — the prerequisites, configuration files, and gotchas in one place.
My review of INE's Certified Cloud Associate (ICCA) exam — how I prepared, what the exam was like, and the notes and resources that got me certified.
A Deep Dive into the Royal Elementor Addons Plugin Vulnerability and How to Protect Your WordPress Site.
A network forensics writeup from AirTech CTF 2024 — spotting the flag smuggled one byte at a time inside the SYN packets of the TCP handshake.
A network forensics writeup from AirTech CTF 2024 — following a TCP stream in Wireshark, carving a file out of FTP traffic, and brute-forcing its cipher down to the flag.
Tips, tricks, and tooling I use to move fast in Attack & Defence CTFs — from patching vulnerable services to spotting other players on the box.
A crypto writeup from Cyber Quest CTF 2023 — a simple but time-consuming chain of base conversions and a rotation cipher to decode the flag.
hwat.saucehwat.sauce