security
Cryptofile
A set of tools for file encryption, including a secure file explorer and an automatic encryptor.
// OPERATOR IDENTIFIED
KenjiXsS
Pentest, AppSec & Purple Team
// PROJECT INVENTORY
monitoring
Dexter
A shell script with a collection of security recon tools for CTFs and bug bounty.
api
Task Manager API
An HTTP API in C to manage tasks, integrated with a simple HTML/JavaScript frontend.
iot
Raspberry Pi Network Monitor
An HTTP server on the Raspberry Pi Pico W to monitor networks and firewalls via Wi-Fi.
web
SINGED FastAPI
A full-stack system for device management integrated with INSS, using FastAPI.
web
SINGED Django
Django version of the SINGED application for device management.
web
E-commerce Frutas
A modern and responsive e-commerce platform specialized in fruits.
web
Go Scraper
A Golang web scraping tool built for studies and data extraction.
web
Neural Network Visualizer
An Anime.js web app to visualize neural networks learning progress.
web
Flashcard Tool
A web tool to create and study flashcards interactively.
api
Ruby API Boilerplate
An API boilerplate built with Ruby on Rails.
// WRITEUPS — CTF LOG
InsaneHackTheBox
Whiterabbit
Multi-layered challenge with deep enumeration and chained unique vulnerabilities across several technologies.
EasyHackTheBox
Artificial
Exploit vulnerabilities in malicious TensorFlow models to achieve RCE, escalate privileges, and capture flags.
MediumHackTheBox
Editor
XWiki RCE exploitation and Privilege Escalation via Netdata (CVE-2024-32019).
HardHackTheBox
Eureka
Java Heapdump extraction and exploitation.
MediumHackTheBox
Nocturne
PHP injection and CVE-2023-46818 exploitation chain.
MediumHackTheBox
Outbound
Roundcube email service exploitation for initial access and privilege escalation.
MediumHackTheBox
Gavel
Credential reuse, insecure SUID binary and PHP config abuse leading to root compromise.
HardHackTheBox
MonitorsFour
IDOR, credential reuse, authenticated Cacti RCE and Docker API abuse leading to full host compromise.
HardHackTheBox
NanoCorp
Active Directory compromise via DNS poisoning, NTLM relay, Kerberos abuse and WinRM access.
HardHackTheBox
Fries
pgAdmin authenticated RCE followed by AD CS abuse (ESC6 + ESC16) to obtain Domain Admin access.
HardHackTheBox
Eloquia
OAuth CSRF leading to admin takeover, DLL upload abuse, SQLite extension execution and binary hijacking.
MediumHackTheBox
Eighteen
SQL Server credential abuse, password reuse and BadSuccessor AD exploitation to gain Domain Admin.
// BUG BOUNTY — FINDINGS LOG
6FINDINGS
$7,550TOTAL PAID
2CRITICAL
2PLATFORMS
HighHackerOne
Stored XSS via File Upload
MediumHackerOne
IDOR on User Profile Endpoint
CriticalBugcrowd
SSRF via PDF Generator
HighHackerOne
SQL Injection in Search Parameter
MediumBugcrowd
Open Redirect to Account Takeover
CriticalHackerOne
Authentication Bypass via JWT None Algorithm
// TRANSMIT MESSAGE
// CONTACT DATA
// EXTERNAL NETWORKS