Web app security, API testing, network pentesting
HackTheBox
Add the target machine IP to /etc/hosts to bind it to a domain name. This makes it easier to reference the target without memorizing the IP address. nano /etc/hosts Check whether the target is accessible via the ping command. Sending only 4 ICMP requests is sufficient; otherwise, it
CTF Writeups
Reconnaissance Add the IP address of the machine to /etc/hosts: nano /etc/hosts Port Scanning Conduct port scan: sudo nmap -sV -sC cicada.htb, sudo nmap -sV -p- --max-rate 10000 cicada.htb Observe that I was dealing with AD structure: Domain Controller Hostname: commonName=CICADA-DC.cicada.htb Domain: cicada.
CTF Writeups
Map IP address to hosts file: nmap -sV -sC -p- --min-rate 5000 -T4 Unusual ports can be seen below: I never had DNS know-how, so I'll search for it. Technically it is not possible to attempt Zone Transfer, yet since I was in a CTF let me give
Vulnerability Research
Important: These PoCs are for an isolated, consented test environment only (e.g., local Bitnami Moodle Docker). Do not run tests against production or third-party systems. Use non-exfiltrative payloads (e.g., alert('stored-xss')) for public demonstrations. Redact any real usernames/hostnames in screenshots before publishing. Summary This PoC
Penetration Testing
Vulnerability Summary * Vulnerability Type: Insecure Direct Object Reference (IDOR) * Component: Moodle – OpenAI Chat Block Plugin (block_openai_chat) v3.0.1 (Build: 2025021700) * Endpoint: /blocks/openai_chat/api/completion.php * Vulnerable Parameter: blockId * Impact: Information Disclosure, Privilege Escalation, Potential Model Misuse * Attack Prerequisites: Authenticated low-privileged user (e.g., student or
Penetration Testing
Date: 17-Oct-2025 Tags: Cybersecurity, responsible-disclosure, penetration-testing Summary * Vulnerability: Stored Cross-Site Scripting (XSS) in Moodle PDF Annotator plugin (mod_pdfannotator) — Public Comments rendering. * CVE: CVE-2025-60506 (assigned) * Discoverer: Onurcan Genç — Independent Security Researcher * Tested environment: Bitnami Docker image for Moodle 4.x * Plugin: mod_pdfannotator v1.5 (release 9, build 2025090300) * Browser