Web Application

Web challenge exploiting a ZIP-based asset upload through magic-byte forgery and a Zip Slip path traversal to plant a malicious Gunicorn hook.

Web challenge exploiting a TOCTOU race condition in a daily reward-claim endpoint using Burp Suite’s parallel Repeater requests to unlock a restricted vault.

Web application challenge chaining OTP brute forcing, a rate-limit bypass, JWT key manipulation, and remote command execution.

Linux box chaining a Spring Boot Actuator session leak into cookie hijacking, command injection, JAR credential discovery, and sudo SSH abuse.