Cosmic Components Co. - UniVsThreats26 Quals Web
Stacking alternating coupons, abusing negative quantities and session-persistent discounts lets us buy every product for pennies, farm loyalty rewards, hit Elite tier, and grab the flag.
Posts
Starlink - UniVsThreats26 Quals Pwn
Chaining a 7-byte format string leak with a strcpy heap overflow to redirect atoi@GOT to system and pop /bin/sh on a non-PIE, partial RELRO Starlink node manager.
Stellar Gateway - UniVsThreats26 Quals Web
Abusing a JWT kid path lookup to /dev/null lets us sign our own admin token with an empty key, unlock the USS Threads Command Center, and capture the flag.
Cheezify - VulnByDefault
Full writeup for the Cheezify machine on VulnByDefault — mobile app reverse engineering leaks hidden subdomains and API keys, leading to SSTI → RCE in a Flask management portal, container pivoting via IMAP email exfiltration, and SSH privilege escalation to root.
HackTheBox #1 Jordan
Achieved #1 ranking on HackTheBox in Jordan through consistent machine pwning, ProLab completions, and challenge solving.
FlagYard #1 Jordan
Achieved #1 ranking on FlagYard in Jordan through CTF challenge solving and consistent performance in competitive cybersecurity.