Bluetooth Risk Scanner: Revealing the Invisible Risks of Everyday BLE Devices
2025-06-01
Introduction
🩶🩶🩶
Dockout: A Red-Team Framework for Automated Container Escape
2025-05-28
Introduction
Simulating CVE-2025-20029 From Vulnerability to PoC
2025-05-01
This post documents the process of understanding and simulating CVE-2025-20029, a remote code execution vulnerability in F5 BIG-IP, by building a self-contai...
Bluetooth Risk Scanner: Revealing the Invisible Risks of Everyday BLE Devices
Introduction
Dockout: A Red-Team Framework for Automated Container Escape
Introduction
Blexploit: Mapping and Exploiting BLE Attack Surfaces with Structured Automation
Introduction
Automating My Writeup Workflow with Writeup-Formatter
Background
Simulating CVE-2025-20029 From Vulnerability to PoC
This post documents the process of understanding and simulating CVE-2025-20029, a remote code execution vulnerability in F5 BIG-IP, by building a self-contai...
Refactoring My Blog for Long-Term Growth
When I first customized the Dark Poole theme for my cybersecurity blog, I quickly realized that small cosmetic changes would not be enough.
How I Built My CyberSecurity Portfolio Blog From Scratch
If I don’t document what I learn, it fades quickly.
Cozyhosting
This box highlights the risks of exposing debugging interfaces in production environments and demonstrates how small misconfigurations—when chained together—...
Editorial
Editorial features a modern CMS hosting platform that suffered from exposed Git history and environment leaks.
Broker
Broker simulates a financial services intranet system hosted on Linux, with misconfigured messaging services and weak file permissions.
Timelapse
Timelapse emulates a modern corporate workstation environment integrated with Active Directory and custom time-tracking software.
Analytics
Analytics simulates a data dashboard built on Node.js and MongoDB with poor session handling and misused admin logic.
Soccer
Soccer features a PHP-based sports forum application with weak input validation and predictable file paths.
Access was gained by exploiting an unauthenticate...
Cicada
Cicada explores a Linux system hosting a misconfigured development IDE that listens on an open port.
Remote
Remote is a Windows machine simulating a corporate helpdesk portal with vulnerable file parsing logic.
Pilgrimage
Pilgrimage is a minimalist Linux target with a stealthy injection vector hidden in a PDF generation module.
Boardlight
Boardlight emulates an internal taskboard system tied to Active Directory with modern user management features.
Love
Love is a web-focused Linux machine that hides a command injection vulnerability behind a modern-looking frontend.
Sau
Sau replicates a lab environment using modern web technologies with subtle misconfigurations.
Magic
Magic presents a Linux web application vulnerable to both insecure file uploads and unsafe PHP function usage.
Giddy
Giddy features a Windows box vulnerable to MS SQL Server misconfigurations and weak service permissions.
Nibbles
Nibbles simulates a lightweight web server hosting a blog engine vulnerable to hardcoded credentials and file upload flaws.
Precious
Precious focuses on a server running a vulnerable document conversion utility.
Querier
Querier revolves around a vulnerable MS SQL Server configured for remote access and weak credentials.
Codify
Codify demonstrates the risks of poorly configured internal APIs and CI/CD exposure.
Busqueda
Busqueda mimics a medium-sized enterprise environment with Active Directory Certificate Services (AD CS) misconfigurations.
Devvortex
Devvortex replicates a modern CI/CD pipeline environment with misconfigured Git services.
Knife
Knife is a Linux machine that demonstrates the danger of exposing development tools in production environments.
Tabby
Tabby simulates a corporate server hosting a vulnerable file sharing platform exposed via LFI (Local File Inclusion).
Return
Return explores a vulnerable PHP web application with insecure handling of serialized data, leading to a PHP object injection vulnerability.
Sauna
Sauna presents a realistic Windows Active Directory environment, offering a strong focus on domain enumeration and Kerberos-based attacks.