Mustafa Kemal Çıngıl

Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the algorithm specified in the JWT header rather than enforcing a fixed algorithm. The tester manipulates the alg header to switch from RS256 to HS256 (using the RSA public key as the HMAC secret), sets alg to none to bypass signature verification, or exploits kid/jku/x5u header injection to supply attacker-controlled keys. Activates for requests involving JWT algorithm confusion, alg none a...

The English summary is being prepared. Showing the original description.

GraphQL saldırıları — introspection, aliased query batching, rate limit bypass

The English summary is being prepared. Showing the original description.

Glibc heap exploitation — tcache poisoning, unsorted bin leak, IO_FILE FSOP

The English summary is being prepared. Showing the original description.

Provides miscellaneous CTF challenge techniques for problems that do not cleanly fit the main categories. Use for encoding puzzles, pyjails, bash jails, RF/SDR, DNS oddities, unicode tricks, esoteric languages, QR or audio puzzles, constraint solving, game theory, unusual sandbox

The English summary is being prepared. Showing the original description.

Implements input and output validation guardrails for LLM-powered applications to prevent prompt injection, data leakage, toxic content generation, and hallucinated outputs. Builds a security validation pipeline using NVIDIA NeMo Guardrails Colang definitions, custom Python validators for PII Tespit and content policy enforcement, and the Guardrails AI framework for structured output validation. The guardrails system intercepts both user inputs (blocking injection attempts, stripping PII, ...

The English summary is being prepared. Showing the original description.

JWT saldırıları — alg:none, HMAC brute-force, floating point bypass, CVE-2022-39227

The English summary is being prepared. Showing the original description.

Discover and inventory shadow API endpoints that operate outside documented specifications using traffic analysis, code scanning, and API discovery platforms.

The English summary is being prepared. Showing the original description.

Tests APIs for injection vulnerabilities including SQL injection, NoSQL injection, OS command injection, LDAP injection, and Server-Side Request Forgery (SSRF) through API parameters, headers, and request bodies. The tester crafts malicious payloads targeting different backend technologies and injection contexts to extract data, execute commands, or access internal services. Maps to OWASP API8:2023 Security Misconfiguration and API7:2023 SSRF. Activates for requests involving API injection te...

The English summary is being prepared. Showing the original description.

Provides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to turn memory corruption or low-level primitives into code execution or privilege escalation, such as buffer overflows, format strings, heap bugs,

The English summary is being prepared. Showing the original description.

Remote binary exploitation — pwntools remote(), socket yönetimi, interactive shell

The English summary is being prepared. Showing the original description.

NX açık, ASLR varsa libc leak + system("/bin/sh") zinciri

The English summary is being prepared. Showing the original description.

Z3 SMT solver ile CTF constraint çözme — byte equations, hash collision, validator bypass

The English summary is being prepared. Showing the original description.

HTTP Request Smuggling — frontend/backend HTTP parser uyumsuzluğunu sömürerek auth bypass, cache poisoning, internal endpoint erişimi

The English summary is being prepared. Showing the original description.

Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, req

The English summary is being prepared. Showing the original description.

OSINT kişi araştırması — sosyal medya, EXIF, bcrypt crack, geolocation

The English summary is being prepared. Showing the original description.

Web race condition exploitation — TOCTOU, single-packet attack, limit overrun, parallel race testing

The English summary is being prepared. Showing the original description.

printf format string ile arbitrary read/write — GOT overwrite, libc leak, RCE

The English summary is being prepared. Showing the original description.

Aynı N ile iki farklı e kullanılarak şifrelenmiş mesaj, extended GCD ile çözülür

The English summary is being prepared. Showing the original description.

RSA PKCS#1 v1.5 padding oracle saldırısı — Bleichenbacher'in 1998 saldırısı

The English summary is being prepared. Showing the original description.

Görüntü steganografi — LSB/MSB, alpha kanal, metadata, file carving tespiti ve Python Pillow ile her kanalın bit-seviyesinde analizi.

The English summary is being prepared. Showing the original description.

Implement API abuse Tespit using token bucket, sliding window, and adaptive rate limiting algorithms to prevent DDoS, brute force, and credential stuffing attacks.

The English summary is being prepared. Showing the original description.

Insecure deserialization — Python pickle, Java, PHP object injection ile RCE

The English summary is being prepared. Showing the original description.

tespit etme
and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.

The English summary is being prepared. Showing the original description.

Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-c

The English summary is being prepared. Showing the original description.