Evidence, systems, and the notes between them.

XSSpecter

An Automated Framework for End-to-End Blind XSS Detection and Reporting

A modular framework that connects blind-XSS discovery, uniquely tagged payloads, callback capture, forensic evidence, alerting, and structured reporting.

• blind xss
• web
• automation
• tooling

Client-Side Path Traversal to JSONP-Based XSS

A client-side path traversal primitive becomes script execution when it reaches a same-origin JSONP-capable endpoint. The chain was independently catalogued by Doyensec.

• web
• client side
• xss
• path traversal

Intigriti 1025 RCE Challenge

A controlled challenge analysis covering SSRF-assisted file access, upload validation, and command-execution reasoning.

• web
• ssrf
• rce
• challenge

Intigriti 1221 XSS Challenge

An analysis of referrer behavior, Unicode normalization, and the final cross-site scripting chain.

Originally published in 2021; tools and platform behavior may have changed.

• xss
• unicode
• challenge

Intigriti 1021 XSS Challenge

A public solution and reasoning trail for the October 2021 XSS challenge.

Originally published in 2021; tools and platform behavior may have changed.

• xss
• web
• challenge

Intigriti 0821 XSS Challenge

A prototype-pollution and DOM-XSS challenge analysis involving jquery-deparam and a Google Analytics gadget.

Originally published in 2021; tools and platform behavior may have changed.

• xss
• prototype pollution
• challenge

Intigriti 0321 XSS Challenge

An analysis of predictable CSRF behavior, parsing quirks, iframe behavior, and SameSite cookie considerations.

Originally published in 2021; tools and platform behavior may have changed.

• xss
• web
• challenge

XSSpecter

Blind-XSS workflow automation

The open-source implementation accompanying the IEEE paper, with CLI discovery and a callback-management server.

• blind xss
• python
• node js
• vue
• docker

bcollabtodiscord

Burp Collaborator notifications

A focused utility that forwards Burp Collaborator client interactions into a Discord workflow.

• tooling
• burp suite
• notifications

filter-waf

WAF-aware URL processing

A small Go utility for processing URL lists and separating WAF-protected targets during authorized reconnaissance.

• tooling
• go
• recon

ezxss-callback-handler

Callback processing utility

A compact PHP handler for processing callbacks from an authorized blind-XSS workflow.

• tooling
• php
• blind xss

getallips

Domain and origin-IP research

A utility for collecting IP addresses historically or currently associated with a domain during authorized testing.

• tooling
• recon
• network

Burp Match and Replace Workflow

A practical note on consistently reshaping requests with Burp Suite match-and-replace rules.

Originally published in 2021; tools and platform behavior may have changed.

• tooling
• burp suite
• web

Reflector

Forked Burp extension

A maintained fork of a Burp extension for identifying reflected input while browsing. Presented as a contribution, not original authorship.

• tooling
• burp suite
• xss

HackTalk CTF Lab

Event challenge infrastructure

Public lab material associated with the CTF-focused HackTalk session, including container and challenge application components.

• ctf
• web
• lab

TryHackMe VulnNet

A web-enumeration and privilege-escalation lab spanning local file inclusion, uploads, SSH keys, and tar behavior.

Originally published in 2021; tools and platform behavior may have changed.

• web
• linux
• lab

TryHackMe Reloaded

A reverse-engineering lab using strings, Ghidra, Immunity Debugger, and binary patching.

Originally published in 2021; tools and platform behavior may have changed.

• reverse engineering
• lab

My Bug Bounty Journey

An early personal account of entering cybersecurity and learning through bug bounty programs.

Originally published in 2021 and preserved as a historical account.

• career
• bug bounty

My First Bug — Reflected XSS

The story of an early private-program bounty and a reflected-XSS issue in a JavaScript string context.

Originally published in 2021 and preserved as a historical account.

• xss
• bug bounty
• career