2026-09-18 9 min
[notes]
Mobile API Pentesting: App, Protocol and Backend
Mobile API pentesting: intercepting the real API past certificate pinning, device ID as weak identity, token handling, deep links and WebView.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2026-09-15 9 min
[notes]
Secret Leakage in LLM Applications: Prompts and RAG
Secret leakage in LLM applications: system prompts, tool output, RAG authorization, cross tenant caches, logs and the model provider boundary.
2026-09-14 15 min
[writeup]
Ronin66 Matrioska Writeup
Anonymous FTP leaks an SNMP string, SNMP leaks a service password, a System32 dump gives the Administrator hash, and SeImpersonatePrivilege finishes it.
2026-09-11 14 min
[writeup]
Ronin66 Dungeon Writeup
A Flask dice app drops its Bearer cookie into a SQL query, MySQL as root gives file read and write, and a privileged Compose job hands over the host.
2026-09-11 8 min
[notes]
Model Serialization Risks: Pickle, Joblib and PyTorch
Why model.pkl is code: pickle and joblib trust boundaries, PyTorch weights_only, model registries, and what safetensors and skops actually fix.