Cyber Blog​

Generating malicious office documents targeting a website accepting LibreOffice-compatible documents.

Attacking Active Directory via kerberoasting with a forged silver ticket.

Scenario: Byte Doctor suspects the attacker used a process injection technique to run malicious code within a legitimate process, leaving minimal traces on the file system. The logs reveal Win32 API calls that hint at a specific injection method used in the attack. Your task is to analyze these logs using a tool called API Monitor to uncover the injection technique and identify which legitimate process was targeted. Index: Overview Our approach Malicious binary review Windows

Request Baskets` instance that is vulnerable to Server-Side Request Forgery (SSRF). Leveraging the vulnerability we are to gain access to a `Maltrail` instance that is vulnerable to Unauthenticated OS Command Injection, which allows us to gain a reverse shell.

Summary: A vulnerable web app generated JSON Web Tokens (JWT's) on the client side. The signing secret and client-side generation logic were discoverable in the client JavasScript, allowing me to forge a valid token with elevated privileges and access the admin ticket board. This post shows how the issue was identified, exploited, and how to fix it properly. Client-side JWT token attacks: In normal circumstances the JWT's are signed by the server so endpoints can verify the t

🧩 Attack Summary In this Sherlock Scenario , you step into the role of a SOC analyst investigating a suspected intrusion. By analyzing...

Checkout a server side Node JS Parameter Tampering Vulnerability and how we can fix it.

YouTube Video Writeup Engagement Flow Tools used Burpsuite WhatWeb OWASP ZAP Netcat Linpeas Tactics/Techniques CVE-2023-41425 - Wonder...

Learn how to install Splunk, import security logs, run SPL queries, and build dashboards. Perfect for cybersecurity beginners seeking hands-on skills.

Scenario 🛠️ Scenario Overview An attacker sends a phishing email to the victim, claiming it's an urgent Microsoft Office update. The...

| CVE-2025-29927 (auth bypass in Next.js) | SSRF to scan and find internal services | LFI to steal secrets | Redis injection for command execution

Scenario: FTP Data Exfiltration Investigation - A major incident occurred at Forela. 20 GB of data were stolen from internal s3 buckets.