Elroy_fernandes:~$GitHub
status: actively hunting vulnerabilities

Cybersecurity & Web Security Labs

Hands-on penetration testing write-ups spanning web application security, network exploitation, and Active Directory attack paths — built on PortSwigger, TryHackMe, and self-hosted lab environments, documented the way I'd hand off a finding to a client.

Every report below includes recon notes, PoC code, and remediation guidance.
Filter
msf.console
msf6use exploit/unix/irc/unreal_ircd_3281_backdoor
>set RHOSTS 10.10.x.x
>exploit
CriticalTryHackMe

UnrealIRCd Backdoor RCE & Plaintext Root Credential PrivEsc

Leveraged a well-known command execution backdoor in UnrealIRCd to gain an initial low-privileged footprint, followed by discovering sensitive plaintext root credentials left in /etc/password.txt to achieve full interactive root access over SSH.

NmapMetasploitSSH
Privilege EscalationRead Full Report
burp.proxy
POST/api/v1/session/refresh HTTP/1.1
Host:vulnerable-app.example
Origin:https://attacker.example
CriticalPortSwigger

DOM-Based XSS via postMessage Sink Injection

Identified a DOM-based XSS vulnerability where an unvalidated postMessage handler wrote attacker-controlled data directly into innerHTML. Exploited the sink using a crafted iframe and Burp Suite to achieve arbitrary JavaScript execution in the victim's session.

Burp SuiteDOM InvaderJavaScript
Web SecurityRead Full Report
shell.session
$curl -s https://target/api/session | jq
>{ "role": "admin", "auth": true }
$id
HighTryHackMe

Kerberoasting & Lateral Movement to Domain Admin

Abused a service account with a Kerberoastable weak-password SPN to crack an offline TGS ticket, then chained the recovered credentials with WinRM lateral movement to escalate from a standard domain user to Domain Admin.

ImpacketRubeusHashcatBloodHoundevil-winrm
Active DirectoryRead Full Report
nmap.scan
Nmap scan report for 10.10.14.22
445/tcp open microsoft-ds
3389/tcp open ms-wbt-server
MediumCustom Lab

Linux Privilege Escalation via Misconfigured SUID Binary

Discovered a custom-compiled backup utility deployed with the SUID bit set that shelled out to an unsanitized system() call. Hijacked the PATH environment variable to escalate from a low-privileged shell to root.

LinPEASGTFOBinsGDBBash
Privilege EscalationRead Full Report