Articles

Thinking out loud on offensive security

Write-ups, techniques, and findings from real engagements and lab work. No fluff, just what actually worked.

  • Case Study: IDOR via Predictable Username Generation

    Interesting case study by @nahamsec on HackingHub: https://app.hackinghub.io/hubs/ghost-api

  • CVE-2026-27626: OliveTin

    OliveTin is a tool that lets end-users run shell commands through a web interface. It has two serious bugs (tracked together as CVE-2026-27626) that let an attacker run any command they want on the server, without even needing to log in. Password fields: The app doesn’t clean up what users type into “password” fields before…

  • CVE-2025-55319: Agentic AI in VS Code – RCE

    VS Code has a built-in AI feature (called “Agentic AI”) that can help you write code. This vulnerability is a “command injection” flaw. That’s a fancy way of saying: a hacker can trick the AI into running harmful commands on your computer, as if the hacker was sitting at your keyboard. Uploading a malicious .vsix…

  • CVE 2025-24071

    Server-side ZIP extraction leads to NTLM hash leakage. This specific vulnerability exploits NTLM Hash Leak via RAR/ZIP extraction and .library-ms file. This Windows File Explorer vulnerability allows an attacker to steal NTLM hashes when a user extracts a crafted .zip file. The vulnerability works because Windows Explorer automatically attempts SMB authentication when processing a crafted…

  • Burp Collaborator Server Setup

    To protect clients, setting up a private Collaborator Server is an important step before any out of band web security testing. Considering the number of hours I spent researching the correct DNS settings, I have written a short guide to make life easier… For hosting, a digital ocean droplet was chosen. By default, all ports…