Hi, I'm xhalyl

Bug bounty hunter, CTF player & security enthusiast. I write about the things I break, build, and learn along the way.

#ctf #bugbounty #devops #cybersecurity #personal

// Recent Posts

CyberTEK CTF — NoteKeeper Web Challenge Writeup ctf
Chaining Dangling Markup Injection and CSRF to steal a CSRF token and get an admin bot to verify our account — without executing a single line of JavaScript.

2026-05-04
Intigriti 0426 Challenge — Northstar Notes XSS ctf
Chaining preset-injection, path traversal, DOMPurify config weakening, and strict-dynamic CSP to land a stored XSS in Intigriti's April 2026 challenge by KonaN.

2026-04-22
ShopZone CTF — Blind NoSQL Injection & ObjectId Leak Writeup ctf
Exploiting blind NoSQL injection to leak a MongoDB ObjectId, extract machine bytes from pymongo 3.6.1, and derive a secret file path to read the flag.

2025-05-04
TEKUP Mini CTF — The Spy Series Writeup (0→3) ctf
A 4-part forensics series: hidden base64 in PowerPoint, HTTP log analysis, LUKS disk decryption, and a suspicious Docker image.

2025-03-04
CyberTEK CTF — reCURSED Web Challenge Writeup ctf
Bypassing a recursive path traversal filter using Python's recursion limit, then reading a deleted file via /proc/self/fd.

2025-03-03
CyberTEK CTF — YessYou Web Challenge Writeup ctf
Leaking a flag character by character using a sorting oracle.

2025-03-02
Securinets-TEKUP Ramadan CTF — XSS Web Challenge Writeup ctf
Bypassing DOMPurify, CSP base-uri, and HttpOnly cookies to steal a flag.

2025-03-01