https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/Hunting With L0WK3Y: write-upsBug bounty and CTF write-ups2026-10-31T00:00:00Zhttps://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/username-enumeration-via-subtly-different-responses/PortSwigger Academy — Username enumeration via subtly different responses (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YTo solve the lab, enumerate a valid username, brute-force this user's password, then access their account page.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/username-enumeration-via-different-responses/PortSwigger Academy — Username enumeration via different responses (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YIn this lab we are tasked with identifying which user from the usernames list can be logged into by matching that username with a password from the password list.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/user-role-can-be-modified-in-user-profile/PortSwigger Academy — User role can be modified in user profile (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YWe start off by logging in with the credentials given in the lab description, the only available functionality given to us is to change our email.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/unprotected-admin-functionality-with-unpredictable-url/PortSwigger Academy — Unprotected admin functionality with unpredictable URL (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YThis lab hides a bit of JavaScript in the Page-source, right click anywhere on the homepage and click “Page Source” (the title maybe vary based on your browser)https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/unprotected-admin-functionality/PortSwigger Academy — Unprotected admin functionality (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YThis lab was a pretty short one, after doing a directory and common misconfigured files scanhttps://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/stored-xss-into-onclick-event-with-angle-brackets-and-double-quotes-html-encoded-and-single-quotes-and-backslash-escaped/PortSwigger Academy — Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YWhen the browser later parses the HTML, \' is decoded to a real ', and that does terminate the string.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/stored-xss-into-anchor-href-attribute-with-double-quotes-html-encoded/PortSwigger Academy — Stored XSS into anchor href attribute with double quotes HTML-encoded (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YIn this challenge we are tasked with triggering the alert function by exploiting a vulnerability in the stores’ comment section.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/single-endpoint-race-conditions/PortSwigger Academy — Single-endpoint race conditions (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YThis lab's email change feature contains a race condition that enables you to associate an arbitrary email address with your account.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/sql-injection-vulnerability-in-where-clause-allowing-retrieval-of-hidden-data/PortSwigger Academy — SQL injection vulnerability in WHERE clause allowing retrieval of hidden data (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YClick on the Gifts filter so the page only displays all items with the “Gifts” filter. After doing so take a look at the URLhttps://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/sql-injection-attack-querying-the-database-type-and-version-on-oracle/PortSwigger Academy — SQL injection attack, querying the database type and version on Oracle (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YAs you can see, all products are listed with the payload above. If you change the payload to ' OR 1=2 which is always false then none of the product items would be listed.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/sql-injection-union-attack-retrieving-multiple-values-in-a-single-column/PortSwigger Academy — SQL injection UNION attack, retrieving multiple values in a single column (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3Y/filter?category= is concatenated directly into an SQL query. Because the page echoes the query results, anything you inject through category can be displayed in the catalog.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/sql-injection-union-attack-retrieving-data-from-other-tables/PortSwigger Academy — SQL injection UNION attack, retrieving data from other tables (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YSee and for an understanding of how SQLi works.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/sql-injection-union-attack-finding-a-column-containing-text/PortSwigger Academy — SQL injection UNION attack, finding a column containing text (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YReplace one NULL at a time with the supplied string.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/sql-injection-union-attack-determining-the-number-of-columns-returned-by-the-query/PortSwigger Academy — SQL injection UNION attack, determining the number of columns returned by the query (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3Y/filter?category= parameter of the shop search.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/reflected-xss-into-a-template-literal-with-angle-brackets-single-double-quotes-backslash-and-backticks-unicode-escaped/PortSwigger Academy — Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3Yhttps://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/reflected-xss-into-a-javascript-string-with-single-quote-and-backslash-escaped/PortSwigger Academy — Reflected XSS into a JavaScript string with single quote and backslash escaped (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YWhile testing the search bar, I inspected the HTML and found that the search was being encased in a script tag that was doing some form of sanitation.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/reflected-xss-into-a-javascript-string-with-angle-brackets-and-double-quotes-html-encoded-and-single-quotes-escaped/PortSwigger Academy — Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YIn this lab, the blog search feature is scripted to sanitize single and double quotes to prevent XSS, the script appends an escape character whenever a single quote is passed in the search query.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/reflected-xss-into-a-javascript-string-with-angle-brackets-html-encoded/PortSwigger Academy — Reflected XSS into a JavaScript string with angle brackets HTML encoded (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YIn this lab we are tasked with triggering the alert function by escaping a string being called in JavaScript.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/reflected-xss-into-html-context-with-most-tags-and-attributes-blocked/PortSwigger Academy — Reflected XSS into HTML context with most tags and attributes blocked (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YOn the front store page there is a search bar that can be used to inject our payload.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/referer-based-access-control/PortSwigger Academy — Referer-based access control (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YSimilar to . Modifying the request with an current session token allows you to upgrade any user with the following request URL /admin-roles?username=wiener&action=upgrade and altering the referrer URL…https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/password-reset-broken-logic/PortSwigger Academy — Password reset broken logic (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YThis lab's password reset functionality is vulnerable. To solve the lab, reset Carlos's password then log in and access his "My account" page.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/os-command-injection-simple-case/PortSwigger Academy — OS command injection, simple case (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YHead over to one of the product pages and click the Check stock button, this is send a POST request to the server and containing the parameters productId and storeId.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/limit-overrun-race-conditions/PortSwigger Academy — Limit overrun race conditions (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YTo start things off, log with the credentials provided in the lab, observe that we have \$50.00 in store credit available.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/jwt-authentication-bypass-via-unverified-signature/PortSwigger Academy — JWT authentication bypass via unverified signature (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YBefore starting this lab if you have not done so already, download the JWT Editor plugin from the BApp Store under the extensions tab in Burp Suite, or you can use JWT.io. to follow along.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/insecure-direct-object-references/PortSwigger Academy — Insecure direct object references (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YWe start off this lab with no login but there is a Live chat option. There is a View transcript button that downloads the chat log from the current session.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/file-path-traversal-validation-of-start-of-path/PortSwigger Academy — File path traversal, validation of start of path (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YSimilar to File path traversal, validation of start of path we need to traverse to the file /etc/passwdhttps://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/file-path-traversal-traversal-sequences-blocked-with-absolute-path-bypass/PortSwigger Academy — File path traversal, traversal sequences blocked with absolute path bypass (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YSimilar to we are tasked with retrieving the contents of the /etc/passwd file but this time, there are filters in place to block absolute file path traversal.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/file-path-traversal-simple-case/PortSwigger Academy — File path traversal, simple case (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YIn this lab we will need to perform a path traversal and navigate to the /etc/passwd file.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/exploiting-a-mass-assignment-vulnerability/PortSwigger Academy — Exploiting a mass assignment vulnerability (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YWhen trying to check out we can see a POST to the endpoint /api/checkout being made containing JSON data of the item id and quantity.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/exploiting-xxe-via-image-file-upload/PortSwigger Academy — Exploiting XXE via image file upload (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YIn this lab, we are tasked with exploiting a server vulnerable to XXE vie image upload, after navigating to one of the product pages we can see a comment section when the user can enter their comment…https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/exploiting-xxe-using-external-entities-to-retrieve-files/PortSwigger Academy — Exploiting XXE using external entities to retrieve files (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YThis JavaScript code dynamically handles form submissions for checking stock levels. When the user submits the form, it prevents the default action and sends an HTTP request using the form's method…https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/exploiting-xss-to-perform-csrf/PortSwigger Academy — Exploiting XSS to perform CSRF (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YStart off by logging in with the credentials provided wiener:peter and change your email to obtain the POST request being sent to the /my-account/change-email endpoint.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/exploiting-xinclude-to-retrieve-files/PortSwigger Academy — Exploiting XInclude to retrieve files (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YThis lab is a continuation of XXE related attacks except this one focuses on XInclude or XML Inclusions, a standard defined by the World Wide Web Consortium (W3C) that allows an XML document to…https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/exploiting-nosql-operator-injection-to-bypass-authentication/PortSwigger Academy — Exploiting NoSQL operator injection to bypass authentication (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YLet’s start off logging in with the credentials provided and take a look at the request for that login.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/exploiting-llm-apis-with-excessive-agency/PortSwigger Academy — Exploiting LLM APIs with excessive agency (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YAt this point you can log into the carlos user account and delete the user.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/dom-based-open-redirection/PortSwigger Academy — DOM-based open redirection (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YStarting off with testing the store pages functionality, we make our way to one of the product pages, right clicking on the < Back to Blog button and inspecting it’s element, we see this code embedded…https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/dom-xss-in-document-write-sink-using-source-location-search-inside-a-select-element/PortSwigger Academy — DOM XSS in document.write sink using source location.search inside a select element (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YLet’s begin with interacting with the site to get an understanding of it’s functionality and see where we can exploit any vulnerabilities.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/dom-xss-in-document-write-sink-using-source-location-search/PortSwigger Academy — DOM XSS in document.write sink using source location.search (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YIn this lab I’m going to try out using Burp Suites’ DOM Invaderhttps://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/blind-sql-injection-with-time-delays/PortSwigger Academy — Blind SQL injection with time delays (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YIn this lab we are tasked with performing a Time-based SQLi of 10 seconds into the tracking cookie. I start things off with my usual testing of the categories on the store page.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/blind-sql-injection-with-conditional-responses/PortSwigger Academy — Blind SQL injection with conditional responses (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YFollowing a similar process to where I tested the category value for SQLi using intruder, I come to find that the category value in the request URL is not susceptible to SQLi.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/blind-os-command-injection-with-time-delays/PortSwigger Academy — Blind OS command injection with time delays (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YInspect the store page then head over to the Submit feedback page, input some test data in the user input.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/blind-os-command-injection-with-output-redirection/PortSwigger Academy — Blind OS command injection with output redirection (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YThis lab contains a blind OS command injection vulnerability in the feedback function.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/basic-server-side-template-injection/PortSwigger Academy — Basic server-side template injection (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YUpon clicking the first View details button for the first product, the message “Unfortunately this product is out of stock” appears above the store item.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/basic-ssrf-against-the-local-server/PortSwigger Academy — Basic SSRF against the local server (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YI start things off by playing around the store page to see what functionality it has. I then proceed to the View details of one of the listed items on the store home page.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/basic-ssrf-against-another-back-end-system/PortSwigger Academy — Basic SSRF against another back-end system (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YThis lab is similar to although for this one we need to iterate of an IP octet to find the correct IP where the admin page is hosted on the back end server.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/hackthebox/spookifier/HackTheBox — Spookifier (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YServer-side template injection in a Mako-rendered font generator: reading util.py, confirming SSTI, and reading the flag with a one-line payload.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/hackthebox/onlyhack/HackTheBox — OnlyHack (Web) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YA dating-app web challenge: stored XSS in the match chat steals a victim's session cookie, which gives access to their account and the flag.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/hackthebox/dont-overreact/HackTheBox — Don't Overreact (Mobile) Walkthrough2026-10-31T00:00:00Z2026-10-31T00:00:00ZL0WK3YReversing a React Native Android app: the flag hides Base64-encoded in a config object inside the minified JavaScript bundle.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/wiz/prompt-airlines-ctf/Wiz — Prompt Airlines CTF (LLM Red Teaming) Walkthrough2026-10-29T00:00:00Z2026-10-29T00:00:00ZL0WK3YGoal: manipulate the Prompt Airlines customer service chatbot into booking a free flight. The CTF has 5 challenges worth 10 points each and was made by Wiz Research (@nirohfeld and @shirtamari).https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/bugforge-io/gift-lab-daily/Bugforge.io — Gift Lab Daily (Web) Walkthrough2026-03-25T00:00:00Z2026-10-29T00:00:00ZL0WK3YAfter logging into the application (“Gift List”), you land on a Dashboard page where you can create new gift lists.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/bugforge-io/copypasta-daily/Bugforge.io — CopyPasta Daily (Web) Walkthrough2026-03-25T00:00:00Z2026-10-29T00:00:00ZL0WK3YThe app exposes a Public Snippets page showing community snippets (JS/Python/CSS/SQL examples).https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/tlamb96/kgb-messenger/tlamb96 — KGB Messenger (Android) Walkthrough2026-01-06T00:00:00Z2026-10-29T00:00:00ZL0WK3YKGB Messenger is a open source CTF practice challenge that aims to help people learn how to reverse engineer Android applications.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/8ksec/ultimate-essay-grader/8kSec — Ultimate Essay Grader (LLM Red Teaming) Walkthrough2026-01-06T00:00:00Z2026-10-29T00:00:00ZL0WK3YAs AI-powered applications become increasingly prevalent in educational technology, understanding their security implications becomes critical.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/8ksec/factsdroid/8kSec — FactsDroid (Android) Walkthrough2026-01-06T00:00:00Z2026-10-29T00:00:00ZL0WK3YLearn the art of network interception. Your goal is to intercept the network traffic generated by FactsDroid in a tool that supports dynamic tampering with network traffic such as Burp Suite or…https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/injured-android/flag-eight-nine-aws-firebase/Injured Android — Flags Eight & Nine: AWS + Firebase (Android) Walkthrough2025-12-23T00:00:00Z2026-10-29T00:00:00ZL0WK3YFlag eight references a Firebase Database, if you checked strings previously, there is a reference to a Firebase URL https://injuredandroid.firebaseio.com.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/injured-android/flag-twelve-protected-components/Injured Android — Flag Twelve: Protected Components (Android) Walkthrough2025-12-23T00:00:00Z2026-10-29T00:00:00ZL0WK3YFor this challenge, you will have to downgrade to SDK 30 (Android 11) as this exploit no longer works on versions 12+ (Explanation towards the bottom).https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/injured-android/flag-thirteen-rce/Injured Android — Flag Thirteen: RCE (Android) Walkthrough2025-12-23T00:00:00Z2026-10-29T00:00:00ZL0WK3YFor this walkthrough I will cover both the "Intended" RCE path (recovering the secret from the binary) and the "Bypass" path (submitting the secret via Deep Link).https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/injured-android/flag-ten-unicode/Injured Android — Flag Ten: Unicode (Android) Walkthrough2025-12-23T00:00:00Z2026-10-29T00:00:00ZL0WK3YThis challenge was a bit tricky as it didn’t make much sense to me as to where to find the email and searching for “android unicode collision” mostly returns other writeup’s for this challenge, so…https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/injured-android/flag-eleven-deep-links/Injured Android — Flag Eleven: Deep Links (Android) Walkthrough2025-12-23T00:00:00Z2026-10-29T00:00:00ZL0WK3YFlag 11 tests your ability to identify entry points in the AndroidManifest.xml (Deep Links) and correlate them with data stored in a backend database (Firebase).https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/injured-android/getting-started-flag-one-login/Injured Android — Getting Started + Flag One: Login (Android) Walkthrough2025-12-22T00:00:00Z2026-10-29T00:00:00ZL0WK3YFor this walkthrough, the application was tested on a Google Pixel 9 XL device running a compatible Android version, but any modern device should work as long as you can install unsigned APKs.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/injured-android/flag-two-exported-activity/Injured Android — Flag Two: Exported Activity (Android) Walkthrough2025-12-22T00:00:00Z2026-10-29T00:00:00ZL0WK3YLooking at the code for FlagTwoActivity I come across two strings being referenced "Key words Activity and exported." and "Exported Activities can be accessed with adb or Drozer.".https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/injured-android/flag-three-resources/Injured Android — Flag Three: Resources (Android) Walkthrough2025-12-22T00:00:00Z2026-10-29T00:00:00ZL0WK3YFor FlagThree there is another string input comparison where the text given to editText is turned into a string and compared with the resource string cmVzb3VyY2VzX3lv to see if they match.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/injured-android/flag-six-login-3/Injured Android — Flag Six: Login 3 (Android) Walkthrough2025-12-22T00:00:00Z2026-10-29T00:00:00ZL0WK3YThis flag follows the same DES decryption process as flag five, all we have to do is keep the same Cyberchef recipe and replace the input value with the new Base64 input.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/injured-android/flag-seven-sqlite/Injured Android — Flag Seven: SQLite (Android) Walkthrough2025-12-22T00:00:00Z2026-10-29T00:00:00ZL0WK3YFor FlagSeven an SQL database has data written to it consisting of Base64 subtitle, and an encoded string from the class and method h.c.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/injured-android/flag-four-login-2/Injured Android — Flag Four: Login 2 (Android) Walkthrough2025-12-22T00:00:00Z2026-10-29T00:00:00ZL0WK3YIn FlagFour I am presented with another login prompt.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/injured-android/flag-five-exported-broadcast/Injured Android — Flag Five: Exported Broadcast (Android) Walkthrough2025-12-22T00:00:00Z2026-10-29T00:00:00ZL0WK3YSince there isn’t much to show as far as UI in the actual application for the challenge, I’ll start with breaking down the FlagFiveActivity.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/source-code-disclosure-via-backup-files/PortSwigger Academy — Source code disclosure via backup files (Web) Walkthrough2025-11-23T00:00:00Z2026-10-29T00:00:00ZL0WK3YThis lab leaks its source code via backup files in a hidden directory. To solve the lab, identify and submit the database password, which is hard-coded in the leaked source code.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/infophreak/infophreak-halloween-ctf-2025-spirit-halloween/Infophreak — Halloween CTF 2025: Spirit Halloween! (Reverse Engineering) Walkthrough2025-11-02T00:00:00Z2026-10-29T00:00:00ZL0WK3YCategory: Web Pentesting/Reverse Engineeringhttps://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/pentesterlab/android-08/PentesterLab — Android 08 (Android) Walkthrough2025-10-25T00:00:00Z2026-10-29T00:00:00ZL0WK3YThis application requires a PIN code to provide you with the key. However, without knowing the PIN, you will not be able to retrieve the key.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/pentesterlab/android-07/PentesterLab — Android 07 (Android) Walkthrough2025-10-25T00:00:00Z2026-10-29T00:00:00ZL0WK3YThis application requires a PIN code to provide you with the key. However, without knowing the PIN, you will not be able to retrieve the key.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/pentesterlab/android-06/PentesterLab — Android 06 (Android) Walkthrough2025-10-25T00:00:00Z2026-10-29T00:00:00ZL0WK3YThis application requires a PIN code to provide you with the key. However, without knowing the PIN, you will not be able to retrieve the key.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/pentesterlab/android-05/PentesterLab — Android 05 (Android) Walkthrough2025-10-25T00:00:00Z2026-10-29T00:00:00ZL0WK3YThis application requires a PIN code to provide you with the key. However, without knowing the PIN, you will not be able to retrieve the key.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/pentesterlab/android-04/PentesterLab — Android 04 (Android) Walkthrough2025-10-25T00:00:00Z2026-10-29T00:00:00ZL0WK3YThis application requires a PIN code to provide you with the key. However, without knowing the PIN, you will not be able to retrieve the key.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/pentesterlab/android-03/PentesterLab — Android 03 (Android) Walkthrough2025-10-25T00:00:00Z2026-10-29T00:00:00ZL0WK3YThis application requires a PIN code to provide you with the key. However, without knowing the PIN, you will not be able to retrieve the key.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/pentesterlab/android-02/PentesterLab — Android 02 (Android) Walkthrough2025-10-25T00:00:00Z2026-10-29T00:00:00ZL0WK3YThis application requires a PIN code to provide you with the key. However, without knowing the PIN, you will not be able to retrieve the key.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/pentesterlab/android-01/PentesterLab — Android 01 (Android) Walkthrough2025-10-25T00:00:00Z2026-10-29T00:00:00ZL0WK3YThis application requires a PIN code to provide you with the key. However, without knowing the PIN, you will not be able to retrieve the key.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/hackthebox/apkey/HackTheBox — APKey (Mobile) Walkthrough2025-09-22T00:00:00Z2026-10-31T00:00:00ZL0WK3YAfter taking a look at the AndroidManifest.xml, you’ll spot the MainActivity which we can navigate to for the core functionality.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/user-role-controlled-by-request-parameter/PortSwigger Academy — User role controlled by request parameter (Web) Walkthrough2025-09-21T00:00:00Z2026-10-29T00:00:00ZL0WK3YThis lab has an admin panel at /admin, which identifies administrators using a forgeable cookie.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/hackthebox/manager/HackTheBox — Manager (Mobile) Walkthrough2025-09-21T00:00:00Z2026-10-31T00:00:00ZL0WK3YLet’s start by taking a look at the application source code in Jadx-GUI to get an understanding of what the application is doing. Head over to the AndroidManifest.xml under the Resources tab.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/information-disclosure-on-debug-page/PortSwigger Academy — Information disclosure on debug page (Web) Walkthrough2025-01-20T00:00:00Z2026-10-29T00:00:00ZL0WK3YThis snippet references a publicly accessible phpinfo.php script under /cgi-bin/. Once navigated to, the page displays output from the phpinfo() function.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/information-disclosure-in-version-control-history/PortSwigger Academy — Information disclosure in version control history (Web) Walkthrough2025-01-09T00:00:00Z2026-10-29T00:00:00ZL0WK3YThis lab discloses sensitive information via its version control history. To solve the lab, obtain the password for the administrator user then log in and delete the user carlos.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/authentication-bypass-via-information-disclosure/PortSwigger Academy — Authentication bypass via information disclosure (Web) Walkthrough2025-01-08T00:00:00Z2026-10-29T00:00:00ZL0WK3YThis lab's administration interface has an authentication bypass vulnerability, but it is impractical to exploit without knowledge of a custom HTTP header used by the front-end.https://l0wk3y-iaan.github.io/Hunting-With-L0WK3Y/writeups/portswigger-academy/information-disclosure-in-error-messages/PortSwigger Academy — Information disclosure in error messages (Web) Walkthrough2025-01-07T00:00:00Z2026-10-29T00:00:00ZL0WK3YThis lab's verbose error messages reveal that it is using a vulnerable version of a third-party framework. To solve the lab, obtain and submit the version number of this framework.