https://jy00x3.github.io//A minimal, responsive and feature-rich Jekyll theme for technical writing. 2026-08-22T23:37:48+00:00 Abdelrahman Hamada Abdelsalam https://jy00x3.github.io// Jekyll © 2026 Abdelrahman Hamada Abdelsalam /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-08-04T00:00:00+00:00 2026-08-22T23:37:30+00:00 https://jy00x3.github.io//posts/PII-DISLOSE/ Abdelrahman Hamada Abdelsalam

1. Introduction While testing the organization’s user-management functionality, I identified a business-logic restriction limiting organizations to five members. Each additional member required an additional payment of $50. This made the membership functionality an interesting target for testing, particularly for race conditions and business-logic bypasses. The initial objective was to under...

2026-04-12T00:00:00+00:00 2026-04-13T16:42:59+00:00 https://jy00x3.github.io//posts/Kerberos-delegation-abuse/ Abdelrahman Hamada Abdelsalam

Overview Kerberos Delegation is one of the most impactful — and most misunderstood — features in Active Directory. Before you can abuse it, you need to understand why it exists, how it works technically, and what the differences between each type are. This post is split into two parts: Part 1 — Concepts: What delegation is, how Kerberos handles it internally, and a deep dive into all thre...

2026-04-09T00:00:00+00:00 2026-04-09T00:00:00+00:00 https://jy00x3.github.io//posts/indeed-ssl/ Abdelrahman Hamada Abdelsalam

🔒 SSL Pinning Bypass Deep Dive In this walkthrough, we analyze and bypass SSL certificate pinning inside an Android application using APKTool static analysis and network security config manipulation. We will: Understand SSL/TLS and how certificate pinning works Identify the pinning mechanism inside the target application Patch the network security configuration Rebuild, resign, and...

2026-03-30T00:00:00+00:00 2026-03-30T00:00:00+00:00 https://jy00x3.github.io//posts/Dark-Zero-HTB/ Abdelrahman Hamada Abdelsalam

Machine Overview Machine Name: DarkZero Difficulty: Hard Operating System: Windows This is a write-up for the Hack The Box machine DarkZero. The machine simulates a realistic enterprise Active Directory environment featuring a dual-domain controller setup and an exposed MSSQL instance. The attack chain demonstrates how a low-privileged domain account can be leveraged to abuse SQL link...

2026-03-29T00:00:00+00:00 2026-03-29T21:43:49+00:00 https://jy00x3.github.io//posts/Gavel-HTB/ Abdelrahman Hamada Abdelsalam

💉 Gavel HTB — PDO SQL Injection to RCE 1️⃣ Initial Enumeration Starting with an Nmap scan against the target: nmap -sV 10.129.242.203 Results showed only two open ports: PORT STATE SERVICE 22/tcp open ssh 80/tcp open http ⚠️ Only SSH and HTTP — this is clearly a web-based machine. Browsing to the web app revealed a standard landing page with Login and Signup options. After r...