SphericalFlower52811
I'm a student who likes cybersecurity. this is my portfolio
my social medias
my projects
-
endpointscanner
-
Extremely accurate website reconnaissance tool made with Python,
made for cybersecurity red teaming to scan modern websites.
-
Scrapes website JavaScript files to find paths in the website, and
includes built-in path normalization by changing paths with
variables like ${var} with 1, or a string of your choice.
-
Includes a built-in customisable rate limit tester for any
endpoint of your choice.
-
clhostmap
-
Tool to check if your website has been impersonated by malicious
actors on domains with different TLDs or on different hosting
providers (e.g. Vercel/Netlify).
-
Contains every TLD and 60+ cloud hosts (e.g. .vercel.app and
.pages.dev)
achievements
-
Security Audits
NOTICE: THESE AUDITS WERE ALL DONE WITH PERMISSION FROM THE
DEVELOPERS OF THE WEBSITES.
Github repo of writeups on vulnerabilities can be found at
Cybersec Repo.
Performed security audit on my classmate's website (which he asked
to keep anonymous). Click for total findings:
-
Python interpreter had a misconfigured Docker and gave every
user root permissions, allowing me to mount it and gain RCE.
-
Path to admin panel which was /admin/api/${userId} (I do not
remember the exact variable name) trusted the client's request
without proper authentication,
allowing me to access the admin panel by simply changing the
request.
-
No rate limiting on all endpoints like /login, /register,
/projects and more, meaning many endpoints were vulnerable to a
potential DoS.
Performed security audit on my teacher's website, that just
belongs to my teacher as an individual not the school's website.
(anonymous because I haven't asked if I can actually put the
website publicly) Click for total findings:
- Swagger UI of the website was exposed.
-
Multiple endpoints like /users/profile, /auth/login had a lack
of rate-limiting, making them vulnerable to a potential DoS via
resource exhaustion.
-
Prompt injection in a quiz question translation feature,
allowing the AI translator to solve questions for you, and
passing a large prompt could potentially slow the website down
or even cause a DoS.
-
Time taken for a question (this website contained quizzes) is
passed by the client, allowing users to put 1 second in a
modified request and the website would trust it.
-
CTFs
-
top 6 in YCEP local to Singapore Polytechnic (not national, but
got me into the national ctf)
-
top 10 in YCEP singapore individual central ctf (national CTF)
-
Certs
- Cisco Introduction to Cybersecurity
- Cisco Python Essentials