Recent content on ~/mzfr
After seeing the tweet from @Fried_rice and reading about the source leak of claude code I got curious. I moved to pi quite a while ago and since then have enjoyed the minimal and highly extensible setup it offers. But seeing the leak got me curious, what are the things in there that I could probably port as extensions in pi. Now while just going from one link to another I came across claw-code…
In this post, I look back on all the stuff I did in 2025
An Android deeplink validation bypass that allowed loading arbitrary domains in the app’s WebView through regex pattern mismatches.
In this post, I look back on all the stuff that I did in 2024
How I went from never running to completing a marathon in less than a year
In this post, I look back on all the stuff that I did in 2023
Took these course in the first semester of my masters
Got accepted at NUS, started Mcomp, and life at Singapore
Generating PDF from HTML containing pie charts from chartjs
In this post, I look back on all the stuff that I did in 2022
Using VS Code, syncthing, and obsidian mobile together for taking notes.
I’ve been lurking around r/selfhosted for quite a while now, and decided to use old raspi to host some simple applications.
Decided to shift from Ubuntu to Arch WSL and found an amazing way to run systemd.
Looking back to all the 2021 stuff that I did
A few months ago one of my friends asked me to help him mint some NFT on the Cardano blockchain. At that point, I had no idea how transactions work on Cardano and how to actually mint any NFT on it. So I started reading all the blog posts I could find and started banging my head on the Cardano documentation. Now I’m writing this series (hopefully) of blog posts because I had to learn things…
In the previous post I talked about what activities are and how we can exploit exported activities. In this post, I’ll show you how an attacker might be able to access the components which are protected i.e not exported . And in the end, I’ll show you how I found one of the similar bugs on a public bug-bounty program. What is this vulnerability? Basically what happens is that an…
So it finally happened, I got my OSCP . This blog post is going to be just me talking about what I did right, what I did wrong and maybe some tips for people who plan to take the exam in the future. PWK Course Also, known as PEN-200 is the course one takes in order to get their OSCP Certification. The official definition for this course is as follows: Penetration Testing with Kali Linux (PEN-200)…
Let’s see if it’s possible to use GitHub action for recon
In this post, I look back on all the stuff that I did in 2020
This blog post doesn’t teach you the very basics of the android app, it just talks about the exported activity and their exploitation
This year I got selected for Google Summer of Code 2020 under The Honeynet Project. This year GSoC was very special for me because I finally got selected for the organization, for which I’ve been trying to get selected from past 2 years. Background I got to know about Google Summer of Code back in 2018, when I learned that my elder brother has done it 3 years in a row. He wanted me to try to…
I had Snare & Tanner running on two different digital ocean’s droplets. I just wanted to see what juicy data I can get using this honeypot. How I deployed it is a different story and I’ll write a different blog post for that. In this post, I just wanted to share small code I wrote as well as some graphs I was able to generate using them. Downloading data using Tanner API Tanner…
If you just want to know how to setup bombsquad jump to The setup section and if you are interested in backstory, continue reading. Back Story Few days into the COVID-19 lockdown and I was already getting bored. I mean I was spending my time either doing my college assignments, that were supposed to be submitted on Google Classroom, or I was just doing various kind of challenges like…
It’s been a while since I wrote any blog post. Since this lockdown is going on I decided to learn a few new things from online courses. I came to know that Basic technology was offering their autopsy basics and hand on (8-hours) training course, worth $495, for free during this COVID-19 crisis. So I decided to take the course since I’m very much interested in digital forensics. My very…
What are Docker containers? Docker containers are a smaller version of Virtual Machines with farless overheads and lot for flexibility. If you want to isolate different services on your system then you can make multiple dockers images for each service and run them, separately. How it works? Well all you need to do is make a file named Dockerfile which would contain the rules/instructions of what…
If you do all the HackTheBox, Vulnhub etc VM you will understand the feeling of getting a reverse shell on the machine but we know that you’re far from home. Finding the right vector for escalating your privileges can be a pain in the ass. I’m going to share some of the methods I completely depends upon for finding those vulnerable vector that helps to escalate privilege on Linux…
Like every Infosec enthusiast I want to do OSCP certification program but when I was reading about it I came across this ceritificate named eJPT so I decided to read about it. Lot of people recommend eJPT as the stepping stone for other bigger certificates like eCPPT or OSCP . After reading numerous reviews and blog posts about eJPT , I decided to take it. The main reason I took this certificate…
Recently I was working on making a new Virtual machine for Vulnhub(it’s in beta right now) and one of the issues I came across was the problem of not having any interface except the loopback ( lo ) in the newly created VM. Now setting a new interface is easy but What I wanted was to set Dynamic DHCP IP so whenever someone starts the VM it’s assigned an IP using which they can attack…
Okay, I gotta start by saying that it been a long time. The last thing I remember was trying to figure out how to rebase my pull requests on Kodi’s repository and praying to pass my first GSoC evaluation. Well, as of now I have passed all the GSoC evaluations, received all my stipend and missed a great trip to Sofia, Bulgaria, yup missed it, but that’s a story for next time.
I got selected as a Google Summer of Code student in XBMC foundation (a.k.a Kodi) for the project [Static code analysis in Kodi’s addon-check tool](Static code analysis in Kodi’s addon-check tool). Result came out on April 23 09:30 PM IST. I know it was 2 months ago but I couldn’t get myself to write about it - you can say I was “busy” ;) What is GSoC ? Google Summer…
My First Blog post
Writeups and walkthrough of all the HackTheBox machines that I’ve done
I am currently pursuing my PhD at the National University of Singapore , advised by Abhik Roychoudhury . For my research, I am exploring automated testing, program analysis, and agentic approaches to finding and fixing software bugs at scale. Before starting my PhD, I completed my master’s at NUS under Manuel Rigger . Prior to that, I worked as a Product Security Engineer at Red Queen…
Writeups and walkthrough of all the Vulnhub machines that I’ve done
Writeups and walkthrough of all the WizardSeclab machines that I’ve done
My Writeups