I break things on purpose so attackers can't. Web, mobile, network and Active Directory security — delivered as clear, prioritised reports.
A spoiler-free look at HackTheBox's Dante Pro Lab — what it covers, who it's for, and how to think about a whole network instead of a single box.
An energy app shipped a device-linking SDK whose Activity was exported with no permission, parsed an unsigned base64 token, and loaded attacker URLs into a JS-enabled WebView wired to native Bluetooth + OAuth bridges. A redacted writeup of an accepted finding.
An endpoint that needed no auth, ignored the user ID, and keyed on a sequential contract ID — leaking an internal GUID and md5(email) for any contract. A redacted writeup of an accepted finding.
Hi, I'm Yasser — a cyber security engineer and CPTS-certified penetration tester. I test networks, apps and domains, then write it all up.