https://elkashawi.github.io/Penetration Testing and Bug Bounty Writeups, HTB Walkthroughs and Cybersecurity Notes. 2026-08-30T11:19:59+03:00 Mohamed Elkashawi https://elkashawi.github.io/ Jekyll © 2026 Mohamed Elkashawi /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-08-30T00:00:00+03:00 2026-08-30T00:00:00+03:00 https://elkashawi.github.io/posts/nexus/ Mohamed Elkashawi

Overview Nexus is a Linux machine that chains several web and infrastructure weaknesses into full system compromise. The attack begins with virtual host enumeration that reveals a self-hosted Gitea instance, where reviewing commit history exposes credentials that were removed in a later commit but remained recoverable. These credentials grant access to an authenticated Krayin CRM panel, which ...

2026-08-09T00:00:00+03:00 2026-08-10T02:16:57+03:00 https://elkashawi.github.io/posts/Unauthenticated-SSRF/ Mohamed Elkashawi

This one started as a pretty simple idea: whenever I see an API parameter that looks like it wants a hostname or a URL, I try feeding it one that points back at me, or at somewhere it really shouldn’t be able to reach. This time it actually worked, and it worked without any authentication at all. Quick note before I get into it: this ended up getting triaged as a duplicate on the platform, som...

2026-08-09T00:00:00+03:00 2026-08-09T00:00:00+03:00 https://elkashawi.github.io/posts/Registration-Bypass/ Mohamed Elkashawi

While I was testing the registration flow of a Magento-based website, I ran into something pretty interesting: I could completely bypass all the frontend security controls just by talking directly to a native Magento REST API. What made it interesting was that the frontend and the backend had two completely different ideas of what it took to create an account. What the “normal” registration l...

2026-08-09T00:00:00+03:00 2026-08-09T05:07:08+03:00 https://elkashawi.github.io/posts/Cache-Deception/ Mohamed Elkashawi

Introduction Web Cache Deception (WCD) is a vulnerability that occurs when a caching layer stores sensitive, user-specific content and later serves it to unauthenticated users. The attack typically exploits discrepancies between how a CDN or reverse proxy interprets a URL and how the backend application processes the same request. Because modern applications rely heavily on CDNs such as Clou...

2026-07-25T00:00:00+03:00 2026-08-09T05:07:08+03:00 https://elkashawi.github.io/posts/silentium/ Mohamed Elkashawi

Overview Silentium is a Linux machine that involves exploiting multiple vulnerabilities to gain full system compromise. The attack begins by discovering a staging virtual host and abusing a password reset vulnerability that exposes reset tokens. After resetting a user’s password, a vulnerable MCP endpoint in Flowise is leveraged to achieve remote code execution. Once access is obtained, envir...