Writing
CloudSEK CTF 2025 Writeup
How I chained five flags in the CloudSEK Hiring CTF: email OSINT to a leaked Git secret, prompt injection and Morse audio, an alg:none JWT forge, an IDOR plus MFA-backup-code bypass, and finally SSRF into EC2 metadata for S3 credentials.
My EVTX triage rules missed 4 of 11 real attack samples. Here's why.
Unit tests passed, then real Windows logs broke four rules. Zero-padded hex, missing parent fields and registry paths I didn't expect.
Scoring reported phishing emails with SPF, DKIM, DMARC and local lure rules
Building an .eml analyser for Indian bank and UPI lures, and what its 9 errors on 69 lab emails taught me.
A small URL shortener where every security control has a test
About 250 lines of FastAPI, each control mapped to an OWASP Top 10 category and a named pytest, then attacked live.
An API test suite should fail on the vulnerable build
Seeding 6 OWASP API defects into a test API to check that the suite catches them, plus 3 bugs schemathesis found on its own.