tl;dr

• Enumerated BLE GATT services and characteristics
• Explored BLE pairing and authentication
• Used MAC spoofing and brute forcing
• Analyzed advertisements and notifications
• Analyzed a BLE PCAP in Wireshark

tl;dr

• Misconfiguration in JWT token validation
• SQL Injection through JWT token
• Insecure Deserialization in .NET leading to RCE using custom class StatusCheckHelper

tl;dr

• Mutation XSS using namespace confusion
• Parsing inconsistency in JSDOM

tl;dr

• XSS + HTML sanitization library (ammonia) bypass
• Namespace confusion in ammonia using custom allowed extra tags(math & style)

tl;dr

• Dynamically resolved hashed API
• Tls_call_back based anti-debug check
• AntiDebugFlag check implemented using ProcessInformationClass
• AES_CBC decryption of image to find flag

tl;dr

• Reverse bytearray to recover matrix cflag.
• Use first element of matrix to recover e (bruteforce &iroot)
• Reduce the flag to finite field of a 32-bit prime, solve for each character.

tl;dr

• Kerberos Exploitation
• MS MySQL Server
• MS14-068
• GoldenTicket

How to crack Shocker box without Metasploit.

tl;dr

• ShellShocker exploit
• Apache mod_cgi

tl;dr

• Linux heap exploitation with arbitary free vulnerability

tl;dr

• linux heap exploitation challenge with glibc 2.30