Writeups

2026.07.31

Skills Assessment — JavaScript Deobfuscation / API Keys

web

2026.07.29

Writeup CRTA Lab — Certified Red Team Analyst

Red team

writeup de CRTA

2026.07.20

CRTA lab Writeup

Red team

writeup de CRTA lab

2026.07.17

Guess the Word — Minimax con Eliminación de Candidatos

algorithms

Resolución del problema Guess the Word de LeetCode usando el algoritmo Minimax con poda de candidatos. Una demostración práctica de teoría de juegos aplicada a la búsqueda de palabras secretas.

2026.07.16

Building H2O — Concurrency en Go

concurrency

Resolución del problema Building H2O de LeetCode usando semáforos y barreras reutilizables en Go. Una demostración práctica de sincronización de hilos.

AWS Cloud Red Teaming Writeup

Azure Cloud Red Teaming Writeup

GCP Cloud Red Teaming Writeup

Teoria vs Practica Cloud Red Team

LABS

1 Username enumeration via different responses

10 Offline password cracking

11 Password reset poisoning via middleware

12 Password brute force via password change

13 Broken brute force protection, multiple credentials per request

2 2FA simple bypass

3 Password reset broken logic

4 Username enumeration via subtly different responses

5 Username enumeration via response timing

6 Broken brute force protection, IP block

7Username enumeration via account lock

8 2FA broken logic

9 Brute forcing a stay logged in cookie

CORS vulnerability with basic origin reflection

CORS vulnerability with trusted null origin

DOM XSS in AngularJS expression with angle brackets and double quotes HTML encoded

DOM XSS in document.write sink using source location.search inside a select element

DOM XSS in document.write sink using source location.search

DOM XSS in innerHTML sink using source location.search

DOM XSS in jQuery anchor href attribute sink using location.search source

DOM XSS in jQuery selector sink using a hashchange event

Reflected DOM XSS

Reflected XSS into a JavaScript string with angle brackets HTML encoded

Reflected XSS into attribute with angle brackets HTML encoded

CSRF vulnerability with no defenses

CSRF where token validation depends on request method

Manipulating WebSocket messages to exploit vulnerabilities

Basic clickjacking with CSRF token protection

Clickjacking with a frame buster script

Clickjacking with form input data prefilled from a URL parameter

Exploiting clickjacking vulnerability to trigger DOM based XSS

Authentication bypass via OAuth implicit flow

Forced OAuth profile linking

OAuth account hijacking via redirect uri

SSRF via OpenID dynamic client registration

Stealing OAuth access tokens via an open redirect

JWT authentication bypass via algorithm confusion with no exposed key

JWT authentication bypass via algorithm confusion

JWT authentication bypass via flawed signature verification

JWT authentication bypass via jku header injection

JWT authentication bypass via jwk header injection

JWT authentication bypass via kid header path traversal

JWT authentication bypass via unverified signature

JWT authentication bypass via weak signing key

1 Limit overrun race conditions

2 Bypassing rate limits via race conditions

3 Multi endpoint race conditions

4 Single endpoint race conditions

5 Exploiting time sensitive vulnerabilities

6 Partial construction race conditions

HTTP request smuggling, confirming a CL.TE vulnerability via differential responses

Modifying serialized objects

Excessive trust in client side controls

Exploiting server side parameter pollution in a REST URL

Insecure direct object references

User ID controlled by request parameter

User role can be modified in user profile

SSRF with whitelist based input filter

SSRFagainstAnotherBackendSystem

Exploiting cache server normalization for web cache deception

Exploiting exact match cache rules for web cache deception

Exploiting origin server normalization for web cache deception

Exploiting path delimiters for web cache deception

Exploiting path mapping for web cache deception

Basic password reset poisoning

Host header authentication bypass

OS command injection, simple case

Blind SQL injection with conditional errors

Blind SQL injection with conditional responses

Blind SQL injection with out of band interaction

Blind SQL injection with time delays and information retrieval

SQL injection UNION attack, determining the number of columns returned by the query

SQL injection UNION attack, finding a column containing text

SQL injection UNION attack, retrieving data from other tables

SQL injection UNION attack, retrieving multiple values in a single column

SQL injection attack, listing the database contents on Oracle

SQL injection attack, listing the database contents on non Oracle databases

SQL injection attack, querying the database type and version on MySQL and Microsoft

SQL injection attack, querying the database type and version on Oracle

SQL injection vulnerability allowing login bypass

SQL injection vulnerability in WHERE clause allowing retrieval of hidden data

SQL injection with filter bypass via XML encoding

Visible error based SQL injection

Exploiting XXE to perform SSRF attacks

Exploiting XXE to retrieve data by repurposing a local DTD

Exploiting XXE using external entities to retrieve files

Exploiting blind XXE to exfiltrate data using a malicious external DTD