Stories and writeups about real-world Hacking from my experience, and guides/tutorials on techniques to learn from. When I find something interesting worth sharing I'll make a post here to tell the story, or when I feel a topic was hard to understand I try to make a clear explanation in a post.
MCP: May Cause Pwnage - Backdoors in Disguise
Together with @AtomicByte, we found some vulnerabilities in the MCP protocol, debugging tools, and scanned for internet-exposed servers. This resulted in a ton of results ranging from headless browsers, databases or code evaluators.
Pressing Buttons with Popups (on Twitch, LinkedIn and more)
Combining existing research with my own experiments to create a realistic proof of concept that forces an OAuth authorization with a single key press. Learn the ins and outs of popup blockers and focusing through URL hashes.
PwnedDoc: Hacking a Reporting Tool
Finding 5 CVEs in the PwnDoc pentest reporting tool, angular-expressions and docx-templater. This includes multiple 1-click Remote Code Execution vulnerabilities by escaping the JavaScript sandbox in the templating engine.
Mutation XSS: Explained, CVE and Challenge
Learn how to bypass HTML sanitizers by abusing the intricate parsing rules and mutations. Including my CVE-2024-52595 (lxml_html_clean bypass) and the solution to a hard challenge I shared online
XS-Leaking flags with CSS: A CTFd 0day
Due to an XS-Leak vulnerability I found in CTFd versions 3.7.2 and below, it was possible to leak flags from admins. Using a novel technique abusing browser history and CSS it could be completely automated
Cracking an online Password Encryption tool
How I recovered a friend's password by reverse engineering an online encryption service, and brute forcing a PIN locally. Learn about AES and black-box discovery, as well as some attacks
Part 2: The New LiveOverflow Minecraft Hacking Server
Part 2 of the LiveOverflow Minecraft Server series. Search for the new server, crack base coordinates from bedrock formations, and teleport through walls!
Playing on the LiveOverflow Minecraft Hacking Server
Finding, and then Playing and learning Game Hacking on a Minecraft server made by LiveOverflow's "Minecraft HACKED" series on YouTube. Learn about port scanning quickly, Fabric modding, and general Game Hacking
Intigriti XSS Challenge
A collection of all monthly Intigriti XSS challenges that I made writeups of. Learn a lot about Web and Cross-Site Scripting vulnerabilities
Getting RCE on a Brute Forcing Assignment
The story and walkthrough of how I got Remote Code Execution on a school assignment meant to teach Brute Forcing
Introduction to Reverse Engineering (with Ghidra)
A very basic introduction to Reverse Engineering using Ghidra. Contains looking at strings, decompiling to C code, and patching instructions.