Cybersecurity Blog by Amal PK – Ethical Hacking, Pentesting, Bug Bounty, CTFs & InfoSec Tips

Write

Part 1: Introduction to Android Security: Architecture, Sandbox, IPC, and System Protections

Jun 5, 20267 min read

Hackthebox Fluffy Walkthrough — Windows Seasonal Box

May 8, 20267 min read

Pinned

Host Header: Small Change, Big Risk

One mistake in the request header - total compromise in return.

Jul 4, 20255 min read

How to Set Up Burp Suite Proxy on Rooted Android with AlwaysTrustUserCerts (Magisk)

May 8, 20264 min read

Dependency Confusion

Nov 11, 20258 min read

Caption HackTheBox Writeup

Compromising the Caption machine by abusing GitBucket and a buggy log service to gain root access.

Jul 7, 20254 min read

Cicada HackTheBox Writeup

An Active Directory journey from user enumeration to domain admin via backup privilege abuse

Jul 7, 202511 min read

NoSQL injection

NoSQL injection is a vulnerability where an attacker is able to interfere with the queries that an application makes to a NoSQL database

May 1, 20254 min read

CRLF Injection: A Critical Web Application Vulnerability

CRLF (Carriage Return Line Feed) injection is a type of attack that targets web applications through the manipulation of HTTP headers. The term “CRLF” refers to the characters used to mark the end of a line in HTTP requests and responses. These chara...

Feb 11, 20255 min read

Web Cache Deception: Understanding and Mitigating Security Risks

Web Cache Deception is a technique that attackers use to manipulate caching systems and mislead web applications into serving unintended content

Jan 29, 20255 min read

Unrested HTB Writeup

About Unrested Unrested is a medium difficulty Linux machine hosting a version of Zabbix. Enumerating the version of Zabbix shows that it is vulnerable to both CVE-2024-36467 (missing access controls on the user.update function within the CUser class...

Jan 28, 20258 min read

Command Palette

Latest articles