alzeaty1/security-writeupsCTF writeups and teaching scripts for web security, bug bounty techniques, and network forensics, with blank-value versions for active practice.
Lab write-ups from self-directed work, mostly TryHackMe, plus a PortSwigger SQLi practical. The reasoning lives on the site — the full methodology, the payloads, the parts where I went wrong first — and this repo is the index and the scripts.
Nine rooms, and they are not nine unrelated things. What they share is that almost none of them needed a novel exploit. What they have in common:
.git directory on a web root. A
password in a daemon's command-line arguments. A Cognito guest role with
dynamodb:Scan on everything. A loopback-bound inspector that only looked safe.Coverage across the set: web exploitation (SQLi, XSS, SSTI, deserialization), cloud credential abuse on both AWS and Azure, network forensics, and OSINT that never touched a server at all.
Some folders ship a Python script. In every case it is a teaching version: the key values, targets, and query templates are left blank or as obvious placeholders on purpose.
The reasoning is simple. A script that works out of the box against a live instance
teaches you the invocation, not the mechanism, and it ages badly. If you open
beachbar_rce.py and it runs, you have learned nothing about why the payload works.
Fill in the blanks from your own traffic, or you have skipped the part that mattered.
Junior penetration tester. Self-directed lab work across web application security, network analysis, and cloud credential abuse (AWS and Azure). Certified through NTI/NTRA (Cybersecurity Academy) and TryHackMe Advent of Cyber 2025 (24 challenges).
MIT
| Room | What it actually was | Difficulty |
|---|
| Beach Bar | PyYAML deserialization RCE, then a root daemon that leaked its own password via /proc | Easy |
| Complimentary | An unauthenticated Cognito role allowed to Scan every table | Easy |
| CryptoCabana | Azure SAS token to service principal to Key Vault — and a rotated secret's version history | Medium |
| Do Not Disturb | {"$ne": ""} login bypass, EJS template injection, loopback Node inspector, two escalations | Medium |
| Overheard at Breakfast | An email as an MD5 input to Gravatar, and no server to attack at all | Easy |
| Packed Light | A keylogger exfiltrating keystrokes one XOR'd cookie at a time | Easy |
| Room 404 | The repository served to anyone who asked for it | Easy |
| SQL Injection | Four oracles, one endpoint | Easy |
| XSS Introduction | One encoding bug in four shapes, ending with blind | Easy |