Knowledge spreader and cybersecurity enthusiast based in Algeria.https://hxuu.github.io/https://hxuu.github.io/blog/misc/keycloak/https://hxuu.github.io/blog/misc/keycloak/a hands-on bug bounty training guide for keycloak identity and access management. covers protocol foundations, fingerprinting, auth flow exploitation, token attacks, SSRF, account takeover chains, and more.Fri, 17 Jul 2026 10:01:07 GMThttps://hxuu.github.io/blog/cloud/labs-dhcp-ovn/https://hxuu.github.io/blog/cloud/labs-dhcp-ovn/10 hands-on labs walking through every layer of DHCP in OVN — from the NB database schema all the way to raw packet construction in ovn-controller's pinctrl. Every concept from the writeup, exercised with hands-on verification.Thu, 16 Jul 2026 23:00:00 GMThttps://hxuu.github.io/blog/cloud/dhcp-writeup/https://hxuu.github.io/blog/cloud/dhcp-writeup/I traced the full lifecycle of DHCP in OVN — from the moment you attach DHCP options to a logical port, through northd scanning, logical flow generation, action encoding, ovn-controller packet-in handling, all the way to the raw DHCP packet being constructed and injected back into the datapath. Here's everything I found along the way.Wed, 15 Jul 2026 23:00:00 GMThttps://hxuu.github.io/blog/misc/challenge-0824intigritiio/https://hxuu.github.io/blog/misc/challenge-0824intigritiio/How I chained a bleach bypass, client-side path traversal, and an open redirect to steal cookies through an outerHTML sink.Wed, 15 Jul 2026 11:00:00 GMThttps://hxuu.github.io/blog/cloud/labs-acl-processing/https://hxuu.github.io/blog/cloud/labs-acl-processing/14 hands-on labs covering every aspect of OVN ACL processing: direction mapping, allow-related conntrack, drop ACLs with BLOCK hints, stateless ACLs, tiered evaluation, universal flows, port groups, reject actions, logging, and more.Fri, 10 Jul 2026 23:00:00 GMThttps://hxuu.github.io/blog/cloud/writeup-acl-processing/https://hxuu.github.io/blog/cloud/writeup-acl-processing/I traced the full lifecycle of an OVN ACL — from the moment you type ovn-nbctl acl-add, through northd scanning, pipeline stage generation, conntrack commitment, all the way to the OpenFlow rules hitting your datapath. Here's everything I found along the way.Thu, 09 Jul 2026 23:00:00 GMThttps://hxuu.github.io/blog/sekai26/filtered-reality/https://hxuu.github.io/blog/sekai26/filtered-reality/A breakdown of my full exploit chain for SEKAI CTF 2026's Filtered Reality challenge. This writeup features WordPress routing desyncs, CSP evasion via SXGs, popping headless Chromium using a V8 WASM bug, and a cryptographic length extension attack.Mon, 06 Jul 2026 16:09:53 GMThttps://hxuu.github.io/blog/sekai26/end/https://hxuu.github.io/blog/sekai26/end/Bypassing script-destination body stripping via HTTP/1.1 socket pooling desynchronization, followed by brute-forcing a cross-origin flag using a Chromium Range Request cache side-channel.Thu, 02 Jul 2026 15:19:59 GMThttps://hxuu.github.io/blog/cloud/vpc-private-subnets-nat-ovn/https://hxuu.github.io/blog/cloud/vpc-private-subnets-nat-ovn/I built a 5-node OVN cluster on libvirt, implemented a VPC with private subnets, SNAT, and load balancing, debugging through a database crash, stale chassis references, a per-chassis conntrack design constraint, and deep OpenFlow tracing. Full technical walkthrough.Mon, 29 Jun 2026 23:00:00 GMThttps://hxuu.github.io/blog/sekai26/ltw/https://hxuu.github.io/blog/sekai26/ltw/Exploiting a TOCTOU race between O_TRUNC+write and unlocked os.ReadFile to freeze a spliced SVG onload payload into a persistent file, turning the admin bot's single GET into a guaranteed XSS.Mon, 29 Jun 2026 12:39:03 GMThttps://hxuu.github.io/blog/alpacahack/zer0tp/https://hxuu.github.io/blog/alpacahack/zer0tp/Cracking an md5 hash and guessing a secret from a truncated zlib compression output: "Zer0TP makes it super easy for service developers to implement an authentication scheme!"Fri, 19 Jun 2026 10:02:09 GMThttps://hxuu.github.io/blog/alpacahack/disco-party/https://hxuu.github.io/blog/alpacahack/disco-party/Challenge about discord's global cache used as XS-Leak oracle: "It's party time right now, so could you refrain from discussing any complicated matters?"Thu, 04 Jun 2026 15:20:36 GMThttps://hxuu.github.io/blog/alpacahack/openbio/https://hxuu.github.io/blog/alpacahack/openbio/This challenge featured CSP bypass using jsdelivr, and small knowledge about Cookie sorting done by the browser.Sun, 24 May 2026 10:45:40 GMThttps://hxuu.github.io/blog/alpacahack/resume-maker/https://hxuu.github.io/blog/alpacahack/resume-maker/This challenge was about resume creation and sharing platform that used PHP serialization to transfer resumes between users.Sat, 23 May 2026 14:52:46 GMThttps://hxuu.github.io/blog/alpacahack/bulk-note/https://hxuu.github.io/blog/alpacahack/bulk-note/This challenge was about a note app than can create multiple notes! The challenge is to read the hidden note.Fri, 22 May 2026 22:15:38 GMThttps://hxuu.github.io/blog/alpacahack/iframe-sandbox/https://hxuu.github.io/blog/alpacahack/iframe-sandbox/This challenge was about an HTML preview service using an iframe. The author hopes the "sandbox" attribute is enough to prevent XSS.Thu, 21 May 2026 18:25:14 GMThttps://hxuu.github.io/blog/cve-2026-4006/https://hxuu.github.io/blog/cve-2026-4006/Most XSS bugs are obvious: unescaped input, wrong function, move on. This one wasn't. I dove into a conditional branch that only fires when an author has no URL, outputting data that absolutely shouldn't. This is a full technical walkthrough: from recon to PoC that takes a Contributor account to Admin XSS.Fri, 27 Mar 2026 10:01:07 GMThttps://hxuu.github.io/blog/apoorv26/journey/https://hxuu.github.io/blog/apoorv26/journey/I dive into a multi-layered OSINT (Open-Source Intelligence) investigation that proves the "old days" of manual, high-dopamine digital sleuthing are far from over in this AI dominated time.Tue, 17 Mar 2026 20:58:12 GMThttps://hxuu.github.io/blog/bits26/rusty-proxy/https://hxuu.github.io/blog/bits26/rusty-proxy/Unlike my usual deep dives, this blog post will contain my thoughts while solving bits CTF 2026 web challenge rusty-proxy which was victim to agentic AI, but insightful nonetheless.Sat, 28 Feb 2026 14:11:11 GMThttps://hxuu.github.io/blog/bsides25/expect/https://hxuu.github.io/blog/bsides25/expect/This challenge demonstrated that security vulnerabilities often exist not in the code itself, but in the glue connecting different components. While the PHP application and the `expect` script appeared logically sound in isolation, the vulnerability emerged from the behavior of the Linux TTY subsystem.Mon, 22 Dec 2025 01:22:05 GMThttps://hxuu.github.io/blog/bsides25/library-vault/https://hxuu.github.io/blog/bsides25/library-vault/I explore a misaligned trust chain between a CDN, a Tornado web app, and an admin bot that allows cache poisoning via a GET request body. This lets us serve an XSS payload to the admin. We then abuse environment variables injection to get RCEMon, 22 Dec 2025 00:09:45 GMThttps://hxuu.github.io/blog/script25/modulo/https://hxuu.github.io/blog/script25/modulo/I exploit Python's introspection and format string tricks to escape a jail that bans letters, digits, and every binary operator except modulo.Mon, 18 Aug 2025 11:42:40 GMThttps://hxuu.github.io/blog/l3ak25/window-of-opportunity/https://hxuu.github.io/blog/l3ak25/window-of-opportunity/I abuse window.opener to navigate the admin's tab to /get_flag and exfiltrate the response, bypassing CSRF protection entirely.Mon, 14 Jul 2025 08:31:33 GMThttps://hxuu.github.io/blog/l3ak25/notorious-note/https://hxuu.github.io/blog/l3ak25/notorious-note/I pollute Object.prototype through a custom query parser to smuggle an onload attribute past sanitize-html's attribute whitelist.Mon, 14 Jul 2025 08:31:13 GMThttps://hxuu.github.io/blog/l3ak25/flag-l3ak/https://hxuu.github.io/blog/l3ak25/flag-l3ak/I exploit a search endpoint that redacts but still matches the flag, using a 3-character sliding window oracle to brute-force it character by character.Mon, 14 Jul 2025 08:31:01 GMThttps://hxuu.github.io/blog/n0ps25/plotwist/https://hxuu.github.io/blog/n0ps25/plotwist/I smuggle HTTP/2 cleartext requests past NGINX to reach a restricted endpoint, then use shell expansion to read the flag under a strict character filter.Wed, 04 Jun 2025 10:09:15 GMThttps://hxuu.github.io/blog/n0ps25/casinops/https://hxuu.github.io/blog/n0ps25/casinops/I bypass a Jinja2 sanitizer by splitting a payload across two form fields, then chain Flask's request object to reach subprocess and execute commands.Mon, 02 Jun 2025 13:28:42 GMThttps://hxuu.github.io/blog/ingeneer25/the-unseen-curse/https://hxuu.github.io/blog/ingeneer25/the-unseen-curse/I simulate iterative knowledge deduction between two players to find the minimum number of nights before one can declare the true total.Thu, 22 May 2025 18:59:22 GMThttps://hxuu.github.io/blog/dice25/pyramid/https://hxuu.github.io/blog/dice25/pyramid/I exploit the gap between Express header handling and Node's body 'end' event to register a self-referring account and compound referrals into 100 billion coins.Tue, 15 Apr 2025 09:42:39 GMThttps://hxuu.github.io/blog/dice25/cookie-recipes-v3/https://hxuu.github.io/blog/dice25/cookie-recipes-v3/I send number[]=1000000000 to trick Express's qs parser into producing an array that passes a length check and coerces to the target number.Sat, 12 Apr 2025 11:18:04 GMThttps://hxuu.github.io/blog/utctf/number-champ/https://hxuu.github.io/blog/utctf/number-champ/I level up a dummy account by abusing the battle endpoint, then trilaterate the target's coordinates from three distance measurements to find their exact address.Tue, 18 Mar 2025 10:14:27 GMThttps://hxuu.github.io/blog/pearl25/tic-tac-toe/https://hxuu.github.io/blog/pearl25/tic-tac-toe/I abuse a URL substitution flaw to reach an exposed dockerd TCP socket, then create a container with the host filesystem mounted to read the flag.Sat, 08 Mar 2025 21:13:34 GMThttps://hxuu.github.io/blog/cyberspace24/trendz/https://hxuu.github.io/blog/cyberspace24/trendz/I exploit a misconfigured Nginx alias to read the jwt.secret file, then forge an admin JWT token to access the hidden post containing the flag.Mon, 02 Sep 2024 10:51:43 GMThttps://hxuu.github.io/blog/cyberspace24/trendzz/https://hxuu.github.io/blog/cyberspace24/trendzz/I send concurrent requests to exploit a non-atomic post count check, exceeding the 12-post threshold needed to unlock the flag endpoint.Mon, 02 Sep 2024 10:13:20 GMThttps://hxuu.github.io/blog/cyberspace24/feature-unlocked/https://hxuu.github.io/blog/cyberspace24/feature-unlocked/I override the validation server via a debug cookie, serve a future-dated signed timestamp from my own server, and chain the unlocked feature into RCE to read the flag.Mon, 02 Sep 2024 09:28:44 GMThttps://hxuu.github.io/blog/sekai24/funny-lfr/https://hxuu.github.io/blog/sekai24/funny-lfr/I race a symlink swap between a large file and /proc/pid/environ to sneak past the os.stat zero-size check and leak the flag from the environment.Fri, 30 Aug 2024 10:01:21 GMThttps://hxuu.github.io/blog/sekai24/intruder/https://hxuu.github.io/blog/sekai24/intruder/I inject a reflection-based payload into an unsanitized Dynamic LINQ Where() call to execute arbitrary commands and read the flag from the filesystem.Tue, 27 Aug 2024 18:14:03 GMThttps://hxuu.github.io/blog/idek24/hello/https://hxuu.github.io/blog/idek24/hello/I bypass a Nginx exact-match rule via PHP-FPM path confusion to expose phpinfo(), then inject a base64-encoded XSS payload using a form feed character as whitespace to exfiltrate the flag.Sun, 18 Aug 2024 21:22:37 GMThttps://hxuu.github.io/blog/lit24/traversed/https://hxuu.github.io/blog/lit24/traversed/I bypass dot-blocking by URL-encoding path separators, then use /proc/self/cwd to resolve the working directory and read the flag file directly.Tue, 13 Aug 2024 18:05:10 GMThttps://hxuu.github.io/blog/lit24/jwt-2/https://hxuu.github.io/blog/lit24/jwt-2/I extract the hardcoded secret key from the source code, re-sign a token with admin set to true, and replace the cookie to pass the signature verification check.Tue, 13 Aug 2024 17:49:06 GMThttps://hxuu.github.io/blog/lit24/jwt-1/https://hxuu.github.io/blog/lit24/jwt-1/I modify the admin field in the JWT payload to true, re-sign it with an arbitrary key, and access the flag since the server performs no signature verification.Tue, 13 Aug 2024 17:34:00 GMThttps://hxuu.github.io/blog/lit24/anti-inspect/https://hxuu.github.io/blog/lit24/anti-inspect/I curl the page to avoid an infinite loop, then run the script in Node.js to resolve the %c format specifier and reveal the actual flag string.Tue, 13 Aug 2024 16:55:33 GMThttps://hxuu.github.io/blog/n00bz24/file-sharing-portal/https://hxuu.github.io/blog/n00bz24/file-sharing-portal/I archive a file named with a Jinja2 payload, exploit Flask's unsanitized render_template_string call, and chain the request object to import os and execute arbitrary commands.Fri, 09 Aug 2024 08:40:00 GMThttps://hxuu.github.io/blog/ctfs-a-beginner-guide/https://hxuu.github.io/blog/ctfs-a-beginner-guide/I share how I got into CTFs, which tools and categories to start with, and why practicing through challenges beats passive learning every time.Thu, 08 Aug 2024 13:08:49 GMT