$ nmap -sV 192.168.1.0/24 PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https $ sqlmap -u http://target/id=1 [*] testing connection [*] checking stability Parameter: id (GET) Type: boolean-based blind $ msfconsole -q msf6 > use exploit/ms17_010 msf6 > set RHOSTS 10.0.0.5 msf6 > exploit [*] Meterpreter session 1 $ gobuster dir -u target.com /admin [200] /login [200] /backup [403] $ nikto -h target.com + Server: Apache/2.4.18 + XSS: header not set + SQLi possible $ hydra -l admin -P rockyou.txt [22][ssh] host: 10.0.0.1 login: admin pass: password123 $ python3 reverse_shell.py Listening on 0.0.0.0:4444 Connection received $ whoami root $ id uid=0(root) gid=0

← back to portfolio

Writeups & Research

CVE research, CTF walkthroughs, bug bounty disclosures, and notes from the trenches of offensive security.

All CVE Research CTF Writeup Bug Bounty Red Teaming Tools & Techniques Penetration Testing

// TAG: AWS (1)

Bug
Bounty

Intermediate

AWS Bug Bounty P1 Critical

$3,000 SSRF Bug: Pivoting from a Public Endpoint to Internal AWS Metadata

How a blind SSRF in an image-processing endpoint exposed internal AWS IAM credentials via the metadata …

Feb 5, 2026 · 9–11 min read