Cybersecurity & Web Security Labs
Hands-on penetration testing write-ups spanning web application security, network exploitation, and Active Directory attack paths — built on PortSwigger, TryHackMe, and self-hosted lab environments, documented the way I'd hand off a finding to a client.
UnrealIRCd Backdoor RCE & Plaintext Root Credential PrivEsc
Leveraged a well-known command execution backdoor in UnrealIRCd to gain an initial low-privileged footprint, followed by discovering sensitive plaintext root credentials left in /etc/password.txt to achieve full interactive root access over SSH.
DOM-Based XSS via postMessage Sink Injection
Identified a DOM-based XSS vulnerability where an unvalidated postMessage handler wrote attacker-controlled data directly into innerHTML. Exploited the sink using a crafted iframe and Burp Suite to achieve arbitrary JavaScript execution in the victim's session.
Kerberoasting & Lateral Movement to Domain Admin
Abused a service account with a Kerberoastable weak-password SPN to crack an offline TGS ticket, then chained the recovered credentials with WinRM lateral movement to escalate from a standard domain user to Domain Admin.
Linux Privilege Escalation via Misconfigured SUID Binary
Discovered a custom-compiled backup utility deployed with the SUID bit set that shelled out to an unsanitized system() call. Hijacked the PATH environment variable to escalate from a low-privileged shell to root.