·374 words·2 mins
From a popped shell to full Kubernetes cluster compromise — exploiting GCP metadata, kubelet credentials, and CSR auto-approval to bypass RBAC.
·469 words·3 mins
Recovering a hidden file from a RAR v5 archive by patching a service header into a file header.
·322 words·2 mins
Exploiting a race condition in database writes and a checksum oracle to brute-force a secret file character by character.
·275 words·2 mins
Abusing Python’s floating point arithmetic to forge JWT-like tokens — when float(‘inf’) meets type juggling.
·762 words·4 mins
Exploiting a format string vulnerability to leak the canary and libc, then ROP to shell via a buffer overflow in a password manager binary.