A writeup for PortSwigger’s Blind SQL Injection with Conditional Responses lab, covering boolean-based testing, administrator password extraction, Burp Intruder, Cluster Bomb, grep match, and binary search logic.
A writeup for a CTF Challenge, covering hidden data extraction, ZIP cracking, web enumeration, API signature forgery, SQLite database analysis, and file read abuse.
My notes and reflections on the USENIX Security 2023 paper Cookie Crumbles, focusing on cookie integrity, SameSite limitations, session fixation, and web pentesting takeaways.