https://walkthrough-by.samgirma.app Latest peer-reviewed CTF writeups, zero-day research, and offensive engineering solutions. en https://walkthrough-by.samgirma.app/w/cyber_ghost/bypassing-waf-nextjs-cache-poisoning https://walkthrough-by.samgirma.app/w/cyber_ghost/bypassing-waf-nextjs-cache-poisoning Reverse proxy header uncloaking combined with Next.js ISR (Incremental Static Regeneration) key poisoning to execute stored XSS on administrative dashboards. WEB cyber_ghost Sat, 22 Jun 2024 08:00:00 GMT https://walkthrough-by.samgirma.app/w/cyber_ghost/lattice-attack-broken-ecdsa-nonces https://walkthrough-by.samgirma.app/w/cyber_ghost/lattice-attack-broken-ecdsa-nonces Recovering the private key from 80 ECDSA signatures with 8 bits of nonce bias using Hidden Number Problem formulation and SageMath LLL reduction. CRYPTO cyber_ghost Sun, 19 May 2024 18:00:00 GMT https://walkthrough-by.samgirma.app/w/0xNullPtr/runc-container-escape-cve-2024-21626 https://walkthrough-by.samgirma.app/w/0xNullPtr/runc-container-escape-cve-2024-21626 A critical vulnerability in runc allowed containerized processes to acquire access to host file system root mounts through lingering file descriptors inherited during clone(CLONE_NEWNS). PWN 0xNullPtr Sat, 18 May 2024 10:00:00 GMT https://walkthrough-by.samgirma.app/w/bin_wizard/unpacking-obfuscated-android-elf-native-libraries https://walkthrough-by.samgirma.app/w/bin_wizard/unpacking-obfuscated-android-elf-native-libraries Dumping dynamically decrypted OLLVM functions from .so memory using Frida hook on JNI_OnLoad and resolving control flow flattening with symbolic execution. REVERSE bin_wizard Mon, 15 Apr 2024 12:00:00 GMT https://walkthrough-by.samgirma.app/w/0xNullPtr/kernel-space-race-slub-double-free https://walkthrough-by.samgirma.app/w/0xNullPtr/kernel-space-race-slub-double-free Exploiting a tight race window in a Linux 6.6 kernel module using userfaultfd and msg_msg spray to obtain arbitrary kernel write and modprobe_path overwrite. PWN 0xNullPtr Fri, 12 Apr 2024 14:30:00 GMT