Python

Web challenge exploiting a ZIP-based asset upload through magic-byte forgery and a Zip Slip path traversal to plant a malicious Gunicorn hook.

Web application challenge chaining OTP brute forcing, a rate-limit bypass, JWT key manipulation, and remote command execution.

A walkthrough of Lakera’s Gandalf Password Reveal levels, covering prompt injection, output transformation, incremental disclosure, and semantic side-channel techniques.

Linux machine chaining manual union-based SQL injection into a phpMyAdmin web shell, a Python command injection, and SUID systemctl abuse for root.