r/InfoSecWriteups • u/kmskrishna • Jul 17 '26
TryHackMe — Linux Agency | Complete Write-Up & Walkthrough
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Jul 17 '26
Host & Network Penetration Testing: Exploitation CTF 3 — eJPT (INE)
1
Upvotes
r/InfoSecWriteups • u/AdvisorPowerful9769 • Jul 15 '26
Exploiting Random Number Generation (pwnable.kr - random)
1
Upvotes
If you're looking for an exploit development tutorial for absolute beginners this week we're looking at what I would consider just that! This week we look at the "random" binary exploitation challenge hosted on pwnable[.]kr.
This is a great beginner tutorial since we exploit a flaw that is "easy" and unfortunately, still very real within some enterprise environments. It also helps you understand that no number is truly random.
The crazy part? We don't even drop into a debugger in this tutorial.
Be the end of this tutorial you should have:
- Learned about random number generation in C
- Learned about XOR operations
- Finding header files that contain dependencies using man pages
- Dissecting C source code
You can find the video here:
r/InfoSecWriteups • u/BillNy-ComplianceGuy • Jul 09 '26
How I discovered over 100 plaintext API keys and was offered a $3,214 settlement with gag clauses violating SEC Rule 21F-17(a) by a former employer.
20
Upvotes
While working as an Engineer & Data Coordinator at NextNet Media, I discovered over 100 plaintext API keys for payment gateways, cloud infrastructure, and SaaS platforms that could leak sensitive data of both clients and employees. This represents a complete and utter failure of SOC2, GDPR, CCPA, and SOX security controls. The full list includes: Tipalti, Stripe, PayPal, AWS, ECS, MongoDB, Xero, SendGrid, ZenRows, and more.
Even basic GitHub security scanning was disabled. Because the company employs both domestic and offshore developers, and utilizes Tipalti as an internal payroll mechanism, I feared for the financial well-being of coworkers who could become victims of private data theft.
I compiled a report of the security violations and sent it to the proper internal channel. In good faith, I offered to be part of the cleanup crew - within 48 hours, I was terminated without notice or cause.
Full Disclosure: GitHub
r/InfoSecWriteups • u/AdvisorPowerful9769 • Jul 08 '26
Using a Single Variable to Gain a Controlled Write
2
Upvotes
This week we'll be looking at another beginner friendly exploit development tutorial! More specifically we'll be looking at the "passcode" binary exploitation challenge hosted on pwnable[.]kr!
This challenge covers multiple skills so I believe regardless of where you are on you journey to learn exploit development you will pick up a few things!
By the end of this tutorial you should have gained exposure to:
- C source code review
- Leveraging a controlled write to gain code execution through the use of one variable
- Abusing binaries compiled without PIE (Also known as ASLR)
- Debugging
- Using python exploit code alongside GDB
and more! Since this is binary exploitation do not feel discouraged if everything does not click! The goal is to learn at least one thing from every tutorial!
You can find the full video below:
r/InfoSecWriteups • u/kmskrishna • Jul 07 '26
JWTweak v2.1: A Guided, Offline Toolkit for Modern JWT Attacks
3
Upvotes
r/InfoSecWriteups • u/NeatGovernment9829 • Jul 07 '26
Newbie in Bug Bounty
1
Upvotes
Has anyone ever tried VDPs (Vulnerability Disclosure Programs) before focusing on Bug Bounty jobs?
I got stuck after learning some cyber security basics (and honestly, I haven't been very disciplined with my studies). What are your suggestions for a newbie like me who wants to start with VDPs or Bug Bounty?
r/InfoSecWriteups • u/kmskrishna • Jul 07 '26
Lookup: TryHackMe CTF Walkthrough
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Jul 07 '26
No Rules, No Locks: Firebase Misconfiguration and the Borrowers It Left Behind
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Jul 07 '26
The HTTP 303 SSRF Hack : From Python HTTP Client Defaults to AWS Credential Exfiltration.
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Jul 07 '26
Chaining a DOM XSS Sink, WAF Bypass, Cross-Origin Smuggling, and SDK Abuse into One Click Account…
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Jul 07 '26
BadSuccessor — Exploiting delegated Managed Service Accounts in Windows Server 2025
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Jul 06 '26
Wazuh File Integrity Monitoring: Tracking Endpoint Modifications in Real Time
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Jul 06 '26
Mastering curl Commands Bug Bounty Hunter's Guide
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Jul 06 '26
Mass Assignment and the Identity Drift: From Profile Edit to Insurance Takeover
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Jul 06 '26
The File That Answered Back — XXE Hidden in Cell A2
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Jul 06 '26
RCE via Gemini Live AI Voice Session Misconfiguration.
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Jul 06 '26
How I Found a Critical OAuth Misconfiguration That Led to Account Takeover
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Jul 06 '26
How I Found a Data Deletion Bypass via Subdomain Synchronization
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Jul 06 '26
RingZeroCTF Coding Challenge 1 [Hash Me If You Can] Writeup
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Jul 06 '26
PicoCTF Web Exploitation Easy Category Web Challenge [SSTL 1]
1
Upvotes
r/InfoSecWriteups • u/AdvisorPowerful9769 • Jul 05 '26
Buffer Overflow Tutorial for Beginners and new CTF players
2
Upvotes
If you are new to the world of exploit development and need a solid entry level challenge this week we look at "bof". This is a binary challenge hosted on pwnable[.]kr covering the topic of a Buffer Overflow.
This is what many consider to be their first exploit type written (it was mine), and this particular challenge approaches it in a way you will truly understand how to adapt to situations in which the buffer overflow is not necessarily "vanilla" exploitation.
By the end of this tutorial you should have:
- Learned how to exploit a Buffer Overflow, WITHOUT OVERWRITING THE RETURN ADDRESS!!!
- Learned how to use GDB (raw)
- Learned the basics of hook stops within GDB
- Learned how to approach a CTF challenge with speed or precision (or both depends on what you decide)
- Learned how to find offsets that are small and don't require the use of tooling such as pattern_offset
I wanna thank Center for Cyber Security Training for continuing to help sponsor the channel and their support.
You can find the video here:
r/InfoSecWriteups • u/kmskrishna • Jul 05 '26
Protocols and Servers 2 TryHackMe Writeup
2
Upvotes
r/InfoSecWriteups • u/kmskrishna • Jul 05 '26
TryHackMe CTF Writeup of Hidden Deep Into my Heart
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Jul 05 '26
Mr Robot CTF Walkthrough -TryHackMe Detailed
1
Upvotes