Mustafa Kemal Çıngıl

Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the algorithm specified in the JWT header rather than enforcing a fixed algorithm. The tester manipulates the alg header to switch from RS256 to HS256 (using the RSA public key as the HMAC secret), sets alg to none to bypass signature verification, or exploits kid/jku/x5u header injection to supply attacker-controlled keys. Activates for requests involving JWT algorithm confusion, alg none a...

中文简介正在准备中。当前显示原文说明。

GraphQL saldırıları — introspection, aliased query batching, rate limit bypass

中文简介正在准备中。当前显示原文说明。

Glibc heap exploitation — tcache poisoning, unsorted bin leak, IO_FILE FSOP

中文简介正在准备中。当前显示原文说明。

Provides miscellaneous CTF challenge techniques for problems that do not cleanly fit the main categories. Use for encoding puzzles, pyjails, bash jails, RF/SDR, DNS oddities, unicode tricks, esoteric languages, QR or audio puzzles, constraint solving, game theory, unusual sandbox

中文简介正在准备中。当前显示原文说明。

Implements input and output validation guardrails for LLM-powered applications to prevent prompt injection, data leakage, toxic content generation, and hallucinated outputs. Builds a security validation pipeline using NVIDIA NeMo Guardrails Colang definitions, custom Python validators for PII Tespit and content policy enforcement, and the Guardrails AI framework for structured output validation. The guardrails system intercepts both user inputs (blocking injection attempts, stripping PII, ...

中文简介正在准备中。当前显示原文说明。

JWT saldırıları — alg:none, HMAC brute-force, floating point bypass, CVE-2022-39227

中文简介正在准备中。当前显示原文说明。

Discover and inventory shadow API endpoints that operate outside documented specifications using traffic analysis, code scanning, and API discovery platforms.

中文简介正在准备中。当前显示原文说明。

Tests APIs for injection vulnerabilities including SQL injection, NoSQL injection, OS command injection, LDAP injection, and Server-Side Request Forgery (SSRF) through API parameters, headers, and request bodies. The tester crafts malicious payloads targeting different backend technologies and injection contexts to extract data, execute commands, or access internal services. Maps to OWASP API8:2023 Security Misconfiguration and API7:2023 SSRF. Activates for requests involving API injection te...

中文简介正在准备中。当前显示原文说明。

Provides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to turn memory corruption or low-level primitives into code execution or privilege escalation, such as buffer overflows, format strings, heap bugs,

中文简介正在准备中。当前显示原文说明。

Remote binary exploitation — pwntools remote(), socket yönetimi, interactive shell

中文简介正在准备中。当前显示原文说明。

NX açık, ASLR varsa libc leak + system("/bin/sh") zinciri

中文简介正在准备中。当前显示原文说明。

Z3 SMT solver ile CTF constraint çözme — byte equations, hash collision, validator bypass

中文简介正在准备中。当前显示原文说明。

HTTP Request Smuggling — frontend/backend HTTP parser uyumsuzluğunu sömürerek auth bypass, cache poisoning, internal endpoint erişimi

中文简介正在准备中。当前显示原文说明。

Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, req

中文简介正在准备中。当前显示原文说明。

OSINT kişi araştırması — sosyal medya, EXIF, bcrypt crack, geolocation

中文简介正在准备中。当前显示原文说明。

Web race condition exploitation — TOCTOU, single-packet attack, limit overrun, parallel race testing

中文简介正在准备中。当前显示原文说明。

printf format string ile arbitrary read/write — GOT overwrite, libc leak, RCE

中文简介正在准备中。当前显示原文说明。

Aynı N ile iki farklı e kullanılarak şifrelenmiş mesaj, extended GCD ile çözülür

中文简介正在准备中。当前显示原文说明。

RSA PKCS#1 v1.5 padding oracle saldırısı — Bleichenbacher'in 1998 saldırısı

中文简介正在准备中。当前显示原文说明。

Görüntü steganografi — LSB/MSB, alpha kanal, metadata, file carving tespiti ve Python Pillow ile her kanalın bit-seviyesinde analizi.

中文简介正在准备中。当前显示原文说明。

Implement API abuse Tespit using token bucket, sliding window, and adaptive rate limiting algorithms to prevent DDoS, brute force, and credential stuffing attacks.

中文简介正在准备中。当前显示原文说明。

Insecure deserialization — Python pickle, Java, PHP object injection ile RCE

中文简介正在准备中。当前显示原文说明。

tespit etme
and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.

中文简介正在准备中。当前显示原文说明。

Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-c

中文简介正在准备中。当前显示原文说明。