Blog
Notes from practice
Writing on certifications, offensive security practice, and the application security work I want to remember in detail later.
- August 19, 2026 · 2 min read
My OSCP Journey
What actually changed between starting PEN-200 and passing the exam. Less about tooling than about method, and about treating every box as a full attack path.
- OSCP
- Penetration testing
- Career
- August 19, 2026In progress
Database Vulnerabilities
A practical walkthrough of database layer weaknesses. Injection beyond the basics, privilege and role misconfiguration, and the escalation paths they open up.
- SQL injection
- Database security
- April 7, 2026 · 3 min read
The Security Control That Ships Turned Off
A widely used open source database lets users fetch external URLs from SQL, and the filter that restricts where those requests can go does nothing until an administrator configures it. Granting read access to external data quietly grants server side request forgery.
- SSRF
- Database security
- Cloud security
- Secure defaults