Selected engagements
Practice environments and lab engagements, written up as findings — target, method, what broke, and how it'd get fixed.
The user-ID search field concatenated input directly into a SQL query with no parameterization. Manual single-quote testing threw a database error, confirming the field was unsanitized. From there, sqlmap enumerated the back-end database, tables, and columns, and extracted the user credential table to demonstrate impact — run purely against the isolated DVWA target, never against anything outside the lab.
At DVWA's "medium" security setting, basic quote-stripping was in place but the query still built as a raw string, so a slightly different payload shape bypassed the filter. The fix in both cases is the same: parameterized queries / prepared statements, so user input is never treated as executable SQL regardless of what filtering sits in front of it.
Comment content was stored raw and rendered without output encoding on the article page, so a script payload in a comment executed for every visitor who viewed the thread — a stored, unauthenticated XSS with wide blast radius. Recommended fix: encode on output (not just sanitize on input), and add a Content-Security-Policy as a second layer of defense.
Nmap service scans surfaced an outdated file-sharing service on one host, which led to an initial low-privilege shell. From there, reused local admin credentials — found in a config file left on the first host — allowed lateral movement to two additional machines, illustrating how a single small hygiene gap (secrets in plaintext config) can cascade into a broader compromise.
Paired the DVWA finding with a short before/after walkthrough rewriting the raw string-concatenated query as a parameterized statement, and re-ran the same sqlmap session against the patched version to confirm the injection no longer succeeded — a concrete way to show a fix actually closes the hole, not just theoretically.
Skills & tooling
Web application testing
- SQL injection (manual & sqlmap)
- XSS — reflected, stored, DOM
- Auth & session flaws
- IDOR / access control
Network & infrastructure
- Nmap service enumeration
- Metasploit exploitation
- Privilege escalation basics
- Lateral movement concepts
Tooling & workflow
- Burp Suite (Proxy, Repeater, Intruder)
- Kali Linux
- Wireshark packet analysis
- Clear, reproducible write-ups