Binary exploitation, exploit development and mobile pentest writeups.https://7heknight.github.io/https://7heknight.github.io/writeups/ast-injection-through-pug/https://7heknight.github.io/writeups/ast-injection-through-pug/A detailed lab note on turning Prototype Pollution into code execution through Pug's AST/code-generation path: vulnerable merge, prototype chain behavior, debugger observations, exploit shape, trigger conditions and defenses.Sun, 17 May 2026 00:00:00 GMThttps://7heknight.github.io/writeups/cve-2026-35616-forticlient-ems-auth-bypass/https://7heknight.github.io/writeups/cve-2026-35616-forticlient-ems-auth-bypass/A deep dive into CVE-2026-35616 — the FortiClient EMS authentication bypass. The Django CertChainAuth middleware blindly trusts the X-SSL-CLIENT-VERIFY HTTP header, so any unauthenticated client can spoof a verified-client-certificate state and walk straight past the auth gate. Full root-cause analysis, a 401→500 detection oracle, an unauthenticated 225 KB data-disclosure endpoint, a read-only enumeration PoC, and remediation.Wed, 13 May 2026 00:00:00 GMThttps://7heknight.github.io/pentest/adb-frida-setup/https://7heknight.github.io/pentest/adb-frida-setup/The foundation every later technique depends on: ADB over USB/Wi-Fi, port forwarding, and getting frida-server running with the correct version and architecture.Sat, 07 Mar 2026 00:00:00 GMThttps://7heknight.github.io/pentest/android-pentest-overview/https://7heknight.github.io/pentest/android-pentest-overview/The big picture: a BurpSuite + Frida workflow for intercepting HTTPS traffic and bypassing security controls on rooted Android, and how the rest of this series fits together.Sat, 07 Mar 2026 00:00:00 GMThttps://7heknight.github.io/pentest/android-trust-store-model/https://7heknight.github.io/pentest/android-trust-store-model/Why your proxy CA strategy depends entirely on the Android version: the three breakpoints — user-store trust (≤6), system-store-only (7+), read-only root (9–10), and APEX (14+) — that decide whether you need root and how you inject the cert.Sat, 07 Mar 2026 00:00:00 GMThttps://7heknight.github.io/pentest/cert-injection-android14/https://7heknight.github.io/pentest/cert-injection-android14/Android 14 moved the CA store under an APEX module with per-process mount namespaces. Injecting a cert now means tmpfs overlay plus nsenter into every Zygote and app namespace.Sat, 07 Mar 2026 00:00:00 GMThttps://7heknight.github.io/pentest/cert-injection-pre14/https://7heknight.github.io/pentest/cert-injection-pre14/Installing a BurpSuite CA into the system trust store on Android 13 and below via direct /system remount, the hash-based filename rule, plus an OpenSSL certificate-operations reference.Sat, 07 Mar 2026 00:00:00 GMThttps://7heknight.github.io/pentest/root-detection-bypass/https://7heknight.github.io/pentest/root-detection-bypass/Apps that refuse to run on rooted devices check packages, binaries, properties and exec calls. How frida_ssl.js neutralises each detection vector at both the Java and native layers.Sat, 07 Mar 2026 00:00:00 GMThttps://7heknight.github.io/pentest/ssl-pinning-bypass/https://7heknight.github.io/pentest/ssl-pinning-bypass/A certificate in the trust store isn't enough when an app pins. Objection for standard stacks, Frida BoringSSL pattern-matching for Flutter and native, and ReFlutter as the static fallback.Sat, 07 Mar 2026 00:00:00 GMThttps://7heknight.github.io/pentest/tools-and-scripts/https://7heknight.github.io/pentest/tools-and-scripts/The three reusable scripts behind the whole workflow — install_cert.sh (APEX-aware cert injection), frida_ssl.js (root + Flutter TLS bypass), LoggingHTTPServer.py — with full source and downloads.Sat, 07 Mar 2026 00:00:00 GMThttps://7heknight.github.io/pentest/traffic-interception/https://7heknight.github.io/pentest/traffic-interception/Three ways to force an app's traffic through BurpSuite: a global HTTP proxy, kernel-level iptables DNAT, and DNS-level invisible proxying — with the ip_forward step everyone forgets.Sat, 07 Mar 2026 00:00:00 GMThttps://7heknight.github.io/writeups/cve-2025-54309-crushftp-rce/https://7heknight.github.io/writeups/cve-2025-54309-crushftp-rce/A full breakdown of CVE-2025-54309 — the CrushFTP zero-day exploited in the wild in July 2025. A logic flaw in loginCheckHeaderAuth() lets a crafted AS2-To header skip authentication entirely, after which an attacker creates an admin account, remaps the Virtual File System to the OS root, drops a malicious Java plugin and reaches remote command execution. Root cause, the bypass-to-RCE kill chain, detection IOCs and remediation.Sat, 02 Aug 2025 00:00:00 GMThttps://7heknight.github.io/writeups/aslr-bruteforce/https://7heknight.github.io/writeups/aslr-bruteforce/When you can't leak an address, you can still win by guessing it. Defeating 32-bit ASLR by hammering a fixed ret2libc payload in a loop until the libc base lines up.Mon, 14 Mar 2022 00:00:00 GMThttps://7heknight.github.io/writeups/hidden-function/https://7heknight.github.io/writeups/hidden-function/Exploiting a SUID binary by overflowing into EIP and redirecting execution to a hidden getshell() function — no shellcode required.Mon, 14 Mar 2022 00:00:00 GMThttps://7heknight.github.io/writeups/linux-bo-foundation/https://7heknight.github.io/writeups/linux-bo-foundation/Buffer overflow fundamentals on Linux: overriding EIP, generating shellcode with msfvenom, finding the buffer address and landing a shell.Mon, 14 Mar 2022 00:00:00 GMThttps://7heknight.github.io/writeups/linux-stack-overflow/https://7heknight.github.io/writeups/linux-stack-overflow/Shellcode injection through an argv overflow on a SUID binary: offset calculation, buffer address discovery and a NOP sled for reliability.Mon, 14 Mar 2022 00:00:00 GMThttps://7heknight.github.io/writeups/nx-bypass-ret2libc/https://7heknight.github.io/writeups/nx-bypass-ret2libc/Defeating the NX bit by returning into libc: chaining system() + exit() + /bin/sh instead of executing injected shellcode.Mon, 14 Mar 2022 00:00:00 GMThttps://7heknight.github.io/writeups/pwnablekr-bof/https://7heknight.github.io/writeups/pwnablekr-bof/The classic pwnable.kr bof level: overflow a stack buffer through gets() to overwrite a function argument and pass the 0xcafebabe check.Mon, 14 Mar 2022 00:00:00 GMThttps://7heknight.github.io/writeups/ret2libc-aslr/https://7heknight.github.io/writeups/ret2libc-aslr/Combining NX and ASLR bypass: leak puts@GOT to recover the libc base, recompute offsets at runtime, then ret2system for a shell.Mon, 14 Mar 2022 00:00:00 GMThttps://7heknight.github.io/writeups/shellcode-reference/https://7heknight.github.io/writeups/shellcode-reference/A practical reference: assembling x86/x64 Linux shellcode with NASM, extracting opcodes with objdump and testing them with a C harness.Mon, 14 Mar 2022 00:00:00 GMThttps://7heknight.github.io/writeups/stack-canary-bypass/https://7heknight.github.io/writeups/stack-canary-bypass/Leaking the stack canary through a format-string information disclosure, then overwriting the return address while keeping the canary intact.Mon, 14 Mar 2022 00:00:00 GMThttps://7heknight.github.io/writeups/windows-stack-smashing/https://7heknight.github.io/writeups/windows-stack-smashing/Classic Windows stack overflow in ASXtoMP3Converter via a malicious .m3u file: cyclic offset, EIP control and a reverse shell through a NOP sled.Mon, 14 Mar 2022 00:00:00 GMT