{"version":1,"pages":[{"id":"yYmkALEQM3M6tu7W7Dqo","title":"whoami","pathname":"/writeups","siteSpaceId":"sitesp_QP1N6","emoji":"2139","description":"This site is a collection of writeups mainly from HackTheBox and CTFs that I participate in"},{"id":"96Eq0ggnKDV1brAUCIg5","title":"Binary Exploitation","pathname":"/writeups/binary-exploitation","siteSpaceId":"sitesp_QP1N6","emoji":"1f469-1f4bb","description":"My own cheat sheet for certain topics I am trying to learn"},{"id":"8bF2YQN6HmgWrxRlsHHU","title":"Basic Binary Protections","pathname":"/writeups/binary-exploitation/basic-binary-protections","siteSpaceId":"sitesp_QP1N6","description":"Just some bad notes","breadcrumbs":[{"label":"Binary Exploitation","emoji":"1f469-1f4bb"}]},{"id":"f8YdKHb1wGrWKQvhwUYw","title":"ROP","pathname":"/writeups/binary-exploitation/rop","siteSpaceId":"sitesp_QP1N6","description":"","breadcrumbs":[{"label":"Binary Exploitation","emoji":"1f469-1f4bb"}]},{"id":"v9JlNePQfjWq0OIch6EM","title":"Format String Bug","pathname":"/writeups/binary-exploitation/format-string-bug","siteSpaceId":"sitesp_QP1N6","description":"Abusinng format string specifiers to leak and write addresses","breadcrumbs":[{"label":"Binary Exploitation","emoji":"1f469-1f4bb"}]},{"id":"qrZ7lLqYNM6Zil7COqcj","title":"Stack Pivoting","pathname":"/writeups/binary-exploitation/stack-pivoting","siteSpaceId":"sitesp_QP1N6","description":"Pivoting for more space, or freedom of payload","breadcrumbs":[{"label":"Binary Exploitation","emoji":"1f469-1f4bb"}]},{"id":"ZNIUEHXof2Yw7rOoI9BG","title":"Partial Overwrite","pathname":"/writeups/binary-exploitation/partial-overwrite","siteSpaceId":"sitesp_QP1N6","description":"Overwriting the LSB of a address or register (E.g RIP)","breadcrumbs":[{"label":"Binary Exploitation","emoji":"1f469-1f4bb"}]},{"id":"7DVlCCt6wTsabPzP10nH","title":"Symbolic Execution","pathname":"/writeups/binary-exploitation/symbolic-execution","siteSpaceId":"sitesp_QP1N6","description":"Cheezing","breadcrumbs":[{"label":"Binary Exploitation","emoji":"1f469-1f4bb"}]},{"id":"Mg2ETqIQFJW3Ol9QvVDa","title":"Heap","pathname":"/writeups/binary-exploitation/heap","siteSpaceId":"sitesp_QP1N6","description":"List of concepts that I am trying to learn","breadcrumbs":[{"label":"Binary Exploitation","emoji":"1f469-1f4bb"}]},{"id":"nkjYPNiRHQGt15zXIzOh","title":"Heap Basics","pathname":"/writeups/binary-exploitation/heap/heap-basics","siteSpaceId":"sitesp_QP1N6","description":"Understanding the basics of the heap","breadcrumbs":[{"label":"Binary Exploitation","emoji":"1f469-1f4bb"},{"label":"Heap"}]},{"id":"nqXI1BKdtSOZfPW9rnec","title":"Heap Overflow","pathname":"/writeups/binary-exploitation/heap/heap-overflow","siteSpaceId":"sitesp_QP1N6","breadcrumbs":[{"label":"Binary Exploitation","emoji":"1f469-1f4bb"},{"label":"Heap"}]},{"id":"SctG79cC32V5VsGn7TK6","title":"Heap Grooming","pathname":"/writeups/binary-exploitation/heap/heap-grooming","siteSpaceId":"sitesp_QP1N6","description":"Manipulating the heap in a certain way","breadcrumbs":[{"label":"Binary Exploitation","emoji":"1f469-1f4bb"},{"label":"Heap"}]},{"id":"5pgfmPhlYBdPLvFV34tR","title":"Use After Free / Double Free","pathname":"/writeups/binary-exploitation/heap/use-after-free-double-free","siteSpaceId":"sitesp_QP1N6","description":"Two common bugs seen in heap","breadcrumbs":[{"label":"Binary Exploitation","emoji":"1f469-1f4bb"},{"label":"Heap"}]},{"id":"6GxTYxCI0HDB3FQC1Qyb","title":"Tcache poisoning","pathname":"/writeups/binary-exploitation/heap/tcache-poisoning","siteSpaceId":"sitesp_QP1N6","description":"just another biN","breadcrumbs":[{"label":"Binary Exploitation","emoji":"1f469-1f4bb"},{"label":"Heap"}]},{"id":"GNLmtK8ihLYzusRyaCwZ","title":"Fast Bin Attack","pathname":"/writeups/binary-exploitation/heap/fast-bin-attack","siteSpaceId":"sitesp_QP1N6","breadcrumbs":[{"label":"Binary Exploitation","emoji":"1f469-1f4bb"},{"label":"Heap"}]},{"id":"GxBHXVa8gAjERRw6aNqY","title":"One By Off Overwrite","pathname":"/writeups/binary-exploitation/heap/one-by-off-overwrite","siteSpaceId":"sitesp_QP1N6","description":"Overwriting the heap by one byte","breadcrumbs":[{"label":"Binary Exploitation","emoji":"1f469-1f4bb"},{"label":"Heap"}]},{"id":"5vh1USKEVkvkaS4Q2EAn","title":"House of Force","pathname":"/writeups/binary-exploitation/heap/house-of-force","siteSpaceId":"sitesp_QP1N6","description":"so much shit","breadcrumbs":[{"label":"Binary Exploitation","emoji":"1f469-1f4bb"},{"label":"Heap"}]},{"id":"eKUS2OZSnC4cjQIMXEhW","title":"Challenges","pathname":"/writeups/hackthebox/challenges","siteSpaceId":"sitesp_QP1N6","description":"Below are a list of challenges that I have done on the HackTheBox platform.","breadcrumbs":[{"label":"HackTheBox","emoji":"1f3ae"}]},{"id":"ruCymZiI9udlu07wa1kh","title":"Baby Website Rick","pathname":"/writeups/hackthebox/challenges/baby-website-rick","siteSpaceId":"sitesp_QP1N6","description":"Pickle Deserialization with a slight twist","breadcrumbs":[{"label":"HackTheBox","emoji":"1f3ae"},{"label":"Challenges"}]},{"id":"qbVJRYdcTz5luyUDQrvr","title":"Space pirate: Entrypoint","pathname":"/writeups/hackthebox/challenges/space-pirate-entrypoint","siteSpaceId":"sitesp_QP1N6","description":"A standard FSB challenge","breadcrumbs":[{"label":"HackTheBox","emoji":"1f3ae"},{"label":"Challenges"}]},{"id":"dtllraZHGNqEpp1hvLSP","title":"Boxes","pathname":"/writeups/hackthebox/boxes","siteSpaceId":"sitesp_QP1N6","description":"Below contains a list of writeups for machines I have done on the main HackTheBox platform.","breadcrumbs":[{"label":"HackTheBox","emoji":"1f3ae"}]},{"id":"O4pegXBWIyGgGl3CNwOK","title":"Voleur","pathname":"/writeups/hackthebox/boxes/voleur","siteSpaceId":"sitesp_QP1N6","description":"quickie","breadcrumbs":[{"label":"HackTheBox","emoji":"1f3ae"},{"label":"Boxes"}]},{"id":"82oiCtDInPDkIGAft6H6","title":"DevOops","pathname":"/writeups/hackthebox/boxes/devoops","siteSpaceId":"sitesp_QP1N6","description":"XXE with a git misconfiguration","breadcrumbs":[{"label":"HackTheBox","emoji":"1f3ae"},{"label":"Boxes"}]},{"id":"HE6wiQkdmobc3Ly8KbiU","title":"Celestial","pathname":"/writeups/hackthebox/boxes/celestial","siteSpaceId":"sitesp_QP1N6","description":"Short Snippet on Node JS deserialization","breadcrumbs":[{"label":"HackTheBox","emoji":"1f3ae"},{"label":"Boxes"}]},{"id":"duY8rOw9EbLI6haYJohA","title":"Fluffy","pathname":"/writeups/hackthebox/boxes/fluffy","siteSpaceId":"sitesp_QP1N6","description":"Quickie","breadcrumbs":[{"label":"HackTheBox","emoji":"1f3ae"},{"label":"Boxes"}]},{"id":"QduNeRk0NItqc5wKM202","title":"Mirage","pathname":"/writeups/hackthebox/boxes/mirage","siteSpaceId":"sitesp_QP1N6","breadcrumbs":[{"label":"HackTheBox","emoji":"1f3ae"},{"label":"Boxes"}]},{"id":"X0MWgQmhb2jVpFwwMGUX","title":"Authority","pathname":"/writeups/hackthebox/boxes/authority","siteSpaceId":"sitesp_QP1N6","description":"A Windows Machine with a heavy emphasis on ADCS and LDAP(s)","breadcrumbs":[{"label":"HackTheBox","emoji":"1f3ae"},{"label":"Boxes"}]},{"id":"MGoPJLFfiJPyH2FdUlnY","title":"CozyHosting","pathname":"/writeups/hackthebox/boxes/cozyhosting","siteSpaceId":"sitesp_QP1N6","description":"A Linux machine with a twist.","breadcrumbs":[{"label":"HackTheBox","emoji":"1f3ae"},{"label":"Boxes"}]},{"id":"2kPwXsaZyZndYGWHDk3P","title":"Analysis","pathname":"/writeups/hackthebox/boxes/analysis","siteSpaceId":"sitesp_QP1N6","description":"A Window Machine with an unintended privilege escalation","breadcrumbs":[{"label":"HackTheBox","emoji":"1f3ae"},{"label":"Boxes"}]},{"id":"p1GFNSwPHaCfCjt8o2Tk","title":"Rebound","pathname":"/writeups/hackthebox/boxes/rebound","siteSpaceId":"sitesp_QP1N6","description":"A Windows Machine which comprises of a multitude of AD vulnerabilities.","breadcrumbs":[{"label":"HackTheBox","emoji":"1f3ae"},{"label":"Boxes"}]},{"id":"UCYniV0IP5tRVQAINx85","title":"DarkZero","pathname":"/writeups/hackthebox/boxes/darkzero","siteSpaceId":"sitesp_QP1N6","description":"As is common in real life pentests, you will start the DarkZero box with credentials for the following account john.w / RFulUtONCOL!","breadcrumbs":[{"label":"HackTheBox","emoji":"1f3ae"},{"label":"Boxes"}]},{"id":"gJJc7yegsy6HJWv2xWDI","title":"CTF Writeups","pathname":"/writeups/ctf-writeups/ctf-writeups","siteSpaceId":"sitesp_QP1N6","description":"A collection of interesting challenges that I solved in various CTFs.","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"}]},{"id":"h0yHhqZ4UNMhtMTZgQ22","title":"BackDoorCTF 2025","pathname":"/writeups/ctf-writeups/ctf-writeups/backdoorctf-2025","siteSpaceId":"sitesp_QP1N6","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"}]},{"id":"4TApSaNsX9O9Rj7uFsnd","title":"Trust Issues","pathname":"/writeups/ctf-writeups/ctf-writeups/backdoorctf-2025/trust-issues","siteSpaceId":"sitesp_QP1N6","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"},{"label":"BackDoorCTF 2025"}]},{"id":"HY5Ka8MUK5njJ4JTwjnK","title":"HeroCTF 2025","pathname":"/writeups/ctf-writeups/ctf-writeups/heroctf-2025","siteSpaceId":"sitesp_QP1N6","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"}]},{"id":"sU7XOh5blme9E1oCK4ct","title":"SpringDrive","pathname":"/writeups/ctf-writeups/ctf-writeups/heroctf-2025/springdrive","siteSpaceId":"sitesp_QP1N6","description":"Hash Collision? + SSRF to Redis RCE","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"},{"label":"HeroCTF 2025"}]},{"id":"LuwsmRGd8EfWuR1d1KN8","title":"BuckeyeCTF 2025","pathname":"/writeups/ctf-writeups/ctf-writeups/buckeyectf-2025","siteSpaceId":"sitesp_QP1N6","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"}]},{"id":"R2x6l8g62MjjbujlPrtN","title":"Authman","pathname":"/writeups/ctf-writeups/ctf-writeups/buckeyectf-2025/authman","siteSpaceId":"sitesp_QP1N6","description":"passwords won't save you now NOTE: remote can only connect to ports 80/443","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"},{"label":"BuckeyeCTF 2025"}]},{"id":"rYWLPYtL57psbiieLL0D","title":"nu1l CTF 25","pathname":"/writeups/ctf-writeups/ctf-writeups/nu1l-ctf-25","siteSpaceId":"sitesp_QP1N6","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"}]},{"id":"tIRdTwWnUHXNzqAB9fad","title":"eezzjs","pathname":"/writeups/ctf-writeups/ctf-writeups/nu1l-ctf-25/eezzjs","siteSpaceId":"sitesp_QP1N6","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"},{"label":"nu1l CTF 25"}]},{"id":"wRAhn14SzSgF4rO4FApY","title":"Sunshine CTF 25","pathname":"/writeups/ctf-writeups/ctf-writeups/sunshine-ctf-25","siteSpaceId":"sitesp_QP1N6","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"}]},{"id":"LxBAqj9KXo36dihcsJlA","title":"Intergalactic Webhook Service","pathname":"/writeups/ctf-writeups/ctf-writeups/sunshine-ctf-25/intergalactic-webhook-service","siteSpaceId":"sitesp_QP1N6","description":"DNS Rebinding","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"},{"label":"Sunshine CTF 25"}]},{"id":"DsQd92xW8Plgurwuuz1W","title":"Greyhats Welcome CTF 25","pathname":"/writeups/ctf-writeups/ctf-writeups/greyhats-welcome-ctf-25","siteSpaceId":"sitesp_QP1N6","description":"Some pwn challenges","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"}]},{"id":"K5PFPrex8ShsuAZ5Jha4","title":"Blast From The Past","pathname":"/writeups/ctf-writeups/ctf-writeups/greyhats-welcome-ctf-25/blast-from-the-past","siteSpaceId":"sitesp_QP1N6","description":"Ret2Shellcode + push rsp gadget","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"},{"label":"Greyhats Welcome CTF 25"}]},{"id":"oT5zTjYUKrIVZNWvMtgH","title":"EchoCrash","pathname":"/writeups/ctf-writeups/ctf-writeups/greyhats-welcome-ctf-25/echocrash","siteSpaceId":"sitesp_QP1N6","description":"GOT overwrite with negative indexing","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"},{"label":"Greyhats Welcome CTF 25"}]},{"id":"eGn5IC6DLjRt1zjx3WC7","title":"Sunshine Factory","pathname":"/writeups/ctf-writeups/ctf-writeups/greyhats-welcome-ctf-25/sunshine-factory","siteSpaceId":"sitesp_QP1N6","description":"Buffer Overflow + Partial Overwrite","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"},{"label":"Greyhats Welcome CTF 25"}]},{"id":"Y2vD4CY5dbeVpYFR6gUQ","title":"USCTF 2024","pathname":"/writeups/ctf-writeups/ctf-writeups/usctf-2024","siteSpaceId":"sitesp_QP1N6","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"}]},{"id":"wvrTC96GIpUbdg5FkM8s","title":"Spooky Query Leaks","pathname":"/writeups/ctf-writeups/ctf-writeups/usctf-2024/spooky-query-leaks","siteSpaceId":"sitesp_QP1N6","description":"INSERT Query SQLi","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"},{"label":"USCTF 2024"}]},{"id":"wYd54gxutQr9T1pQhWTY","title":"HackTheVote","pathname":"/writeups/ctf-writeups/ctf-writeups/hackthevote","siteSpaceId":"sitesp_QP1N6","description":"","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"}]},{"id":"omai7vZdEaNOw7BV5wVd","title":"Comma-Club (Revenge)","pathname":"/writeups/ctf-writeups/ctf-writeups/hackthevote/comma-club-revenge","siteSpaceId":"sitesp_QP1N6","description":"One-Byte Overwrite over Function Pointer","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"},{"label":"HackTheVote"}]},{"id":"SSB2yJdnMnEzDiPuMWss","title":"HeroCTF 2024","pathname":"/writeups/ctf-writeups/ctf-writeups/heroctf-2024","siteSpaceId":"sitesp_QP1N6","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"}]},{"id":"p92cQpMIMo2YO4Nw2OBT","title":"Heappie","pathname":"/writeups/ctf-writeups/ctf-writeups/heroctf-2024/heappie","siteSpaceId":"sitesp_QP1N6","description":"Ret2win in Heap","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"},{"label":"HeroCTF 2024"}]},{"id":"V76QtAH5hNEXytx7W7nL","title":"Buckeye 2024","pathname":"/writeups/ctf-writeups/ctf-writeups/buckeye-2024","siteSpaceId":"sitesp_QP1N6","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"}]},{"id":"LleyQ8AkJDA0O4txFha8","title":"No-Handouts","pathname":"/writeups/ctf-writeups/ctf-writeups/buckeye-2024/no-handouts","siteSpaceId":"sitesp_QP1N6","description":"Ret2Libc except no shell L","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"},{"label":"Buckeye 2024"}]},{"id":"Fl0lqZHpaamiklKGqM2O","title":"TetCTF 2024","pathname":"/writeups/ctf-writeups/ctf-writeups/tetctf-2024","siteSpaceId":"sitesp_QP1N6","description":"","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"}]},{"id":"qIZsxBMoehZLbJpn0L9A","title":"TET & 4N6","pathname":"/writeups/ctf-writeups/ctf-writeups/tetctf-2024/tet-and-4n6","siteSpaceId":"sitesp_QP1N6","description":"A good forensics challenge that was cheesed","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"},{"label":"TetCTF 2024"}]},{"id":"vIgJSUBSNe402sVtttbk","title":"PatriotCTF 2023","pathname":"/writeups/ctf-writeups/ctf-writeups/patriotctf-2023","siteSpaceId":"sitesp_QP1N6","description":"","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"}]},{"id":"2VDbu3nd8n31eXpXxPKx","title":"ML Pyjail","pathname":"/writeups/ctf-writeups/ctf-writeups/patriotctf-2023/ml-pyjail","siteSpaceId":"sitesp_QP1N6","description":"Python Jail with a twist.","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"},{"label":"PatriotCTF 2023"}]},{"id":"QHHoO2ciNQhTSPjJ2ZbE","title":"Breakfast Club","pathname":"/writeups/ctf-writeups/ctf-writeups/patriotctf-2023/breakfast-club","siteSpaceId":"sitesp_QP1N6","description":"Hash Cracking with a caveat","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"CTF Writeups"},{"label":"PatriotCTF 2023"}]},{"id":"0TEQZOyuiMossLV7fYlE","title":"Authored Challenges","pathname":"/writeups/ctf-writeups/authored-challenges","siteSpaceId":"sitesp_QP1N6","description":"Hopefully the list grows longer as time goes on","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"}]},{"id":"uWSrSUnghlm6YRvK0QIc","title":"Team Rocket","pathname":"/writeups/ctf-writeups/authored-challenges/team-rocket","siteSpaceId":"sitesp_QP1N6","description":"Team Rocket is looking for new members to join their global conquest! They have set up a new system to recruit new members. Can you infiltrate their system and find out what they are up to?","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"Authored Challenges"}]},{"id":"NGyOircGM6HZGbB6kIRb","title":"Portal","pathname":"/writeups/ctf-writeups/authored-challenges/portal","siteSpaceId":"sitesp_QP1N6","description":"My company vibecoded a portal for viewing websites, wonder what can go wrong","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"Authored Challenges"}]},{"id":"wVOiI4YpPfEgN0zoRKb6","title":"Upsolves","pathname":"/writeups/ctf-writeups/upsolves","siteSpaceId":"sitesp_QP1N6","description":"Challenges I try to learn from in preparation for CTFs","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"}]},{"id":"kgYB9u4M347uAMwr3gds","title":"Go Touch Grass","pathname":"/writeups/ctf-writeups/upsolves/go-touch-grass","siteSpaceId":"sitesp_QP1N6","description":"Scroll-To-Text-Fragment with DNS Prefetch","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"Upsolves"}]},{"id":"urBQc6w0ilHJ3QjdyPRS","title":"Secure Blob Runner","pathname":"/writeups/ctf-writeups/upsolves/secure-blob-runner","siteSpaceId":"sitesp_QP1N6","description":"Shellcode with ROP via fs_base leak","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"Upsolves"}]},{"id":"VUAEWXF6xWLx5xeZZ3pN","title":"HAKKShop","pathname":"/writeups/ctf-writeups/upsolves/hakkshop","siteSpaceId":"sitesp_QP1N6","description":"logic bugs + verb tampering?","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"Upsolves"}]},{"id":"v8axykVecJOLyMz66SMH","title":"Trading-API","pathname":"/writeups/ctf-writeups/upsolves/trading-api","siteSpaceId":"sitesp_QP1N6","description":"hacklu-ctf 2021","breadcrumbs":[{"label":"CTF Writeups","emoji":"1f4c4"},{"label":"Upsolves"}]}]}