https://ibrahimsql.tr/en/posts/oscp-pen200-03-vulnerability-scanning https://ibrahimsql.tr/api/og?title=PEN-200%20Series%2C%20Part%203%3A%20Vulnerability%20Scanning%20%E2%80%94%20and%20Catching%20a%20Scanner%20Lying PEN-200 Series, Part 3: Vulnerability Scanning — and Catching a Scanner Lying Interpreting original Nmap and Nuclei lab output, checking the Range detector's real HEAD requests, separating scanner heuristics from proof, and keeping Nessus outside the OSCP+ exam. https://ibrahimsql.tr/tr/posts/oscp-pen200-03-zafiyet-tarama https://ibrahimsql.tr/api/og?title=PEN-200%20Serisi%2C%20B%C3%B6l%C3%BCm%203%3A%20Zafiyet%20Taramas%C4%B1%20%E2%80%94%20ve%20Bir%20Taray%C4%B1c%C4%B1y%C4%B1%20Yalan%20S%C3%B6ylerken%20Yakalamak PEN-200 Serisi, Bölüm 3: Zafiyet Taraması — ve Bir Tarayıcıyı Yalan Söylerken Yakalamak Özgün Nmap ve Nuclei lab çıktısını yorumlamak, Range kontrolünün gerçek HEAD isteklerini incelemek, sezgisel uyarıyı kanıttan ayırmak ve Nessus'u OSCP+ sınavının dışında tutmak. https://ibrahimsql.tr/en/posts/owasp-top-10-2025-en https://ibrahimsql.tr/api/og?title=OWASP%20Top%2010%3A2025%20%E2%80%94%20What%20Each%20Risk%20Category%20Actually%20Covers OWASP Top 10:2025 — What Each Risk Category Actually Covers A category-by-category reading of the OWASP Top 10:2025 release: what each of the ten risks means, what changed from 2021, how to test for it, and where this site covers the same ground in depth. https://ibrahimsql.tr/tr/posts/owasp-top-10-2025-tr https://ibrahimsql.tr/api/og?title=OWASP%20Top%2010%3A2025%20%E2%80%94%20Her%20Risk%20Kategorisi%20Asl%C4%B1nda%20Neyi%20Kaps%C4%B1yor OWASP Top 10:2025 — Her Risk Kategorisi Aslında Neyi Kapsıyor OWASP Top 10:2025 sürümünün kategori kategori okunması: on riskin her biri ne anlama geliyor, 2021'e göre ne değişti, nasıl test edilir ve bu sitede aynı konu nerede derinlemesine işleniyor. https://ibrahimsql.tr/en/posts/bitsctf-2026-rusty-proxy-writeup-en https://ibrahimsql.tr/api/og?title=BITSCTF%202026%20%E2%80%94%20rusty_proxy%20Writeup BITSCTF 2026 — rusty_proxy Writeup A Rust reverse proxy guards /admin with a naive prefix check. It lowercases the path but never decodes it, so a percent-encoded byte slips the request past the proxy and straight into the Flask route that returns the flag. https://ibrahimsql.tr/tr/posts/bitsctf-2026-rusty-proxy-writeup-tr https://ibrahimsql.tr/api/og?title=BITSCTF%202026%20%E2%80%94%20rusty_proxy%20%C3%87%C3%B6z%C3%BCm%C3%BC BITSCTF 2026 — rusty_proxy Çözümü Rust ile yazılmış bir ters proxy, /admin yolunu basit bir ön ek kontrolüyle koruyor. Yolu küçük harfe çeviriyor ama hiçbir zaman kodunu çözmüyor; bu yüzden yüzde kodlamalı bir bayt kontrolü atlatıp doğrudan bayrağı döndüren Flask rotasına ulaşıyor. https://ibrahimsql.tr/en/posts/bitsctf-2026-safepaste-writeup-en https://ibrahimsql.tr/api/og?title=BITSCTF%202026%20%E2%80%94%20SafePaste%20Writeup BITSCTF 2026 — SafePaste Writeup A paste site sanitizes with DOMPurify and then feeds the result to String.prototype.replace: the $& and $` replacement patterns smuggle a live iframe past the sanitizer, and a /hidden-scoped flag cookie is read through a same-origin 404 frame. https://ibrahimsql.tr/tr/posts/bitsctf-2026-safepaste-writeup-tr https://ibrahimsql.tr/api/og?title=BITSCTF%202026%20%E2%80%94%20SafePaste%20Writeup BITSCTF 2026 — SafePaste Writeup Bir paste sitesi girdiyi DOMPurify ile temizleyip sonucu String.prototype.replace'e veriyor: $& ve $` replacement pattern'leri sanitizer'ı atlayarak canlı bir iframe sokuyor ve /hidden kapsamlı flag çerezi aynı origin'deki 404 frame üzerinden okunuyor. https://ibrahimsql.tr/en/posts/codegate-2026-erp-system-writeup-en https://ibrahimsql.tr/api/og?title=Codegate%202026%20%E2%80%94%20ERP_system%20Writeup Codegate 2026 — ERP_system Writeup A PHP stream filter that hashes whatever it reads turns into an oracle: chain an SSRF in hash.php through a public redirector to a localhost-only secret reader, then recover the flag one byte at a time from a 500-vs-200 side channel. https://ibrahimsql.tr/tr/posts/codegate-2026-erp-system-writeup-tr https://ibrahimsql.tr/api/og?title=Codegate%202026%20%E2%80%94%20ERP_system%20%C3%87%C3%B6z%C3%BCm%C3%BC Codegate 2026 — ERP_system Çözümü Okuduğu her şeyi hash'leyen bir PHP stream filtresi oracle'a dönüşüyor: hash.php'deki SSRF'i halka açık bir yönlendirici üzerinden yalnız-localhost sır okuyucusuna zincirle, ardından bayrağı 500-e karşı-200 yan kanalından bayt bayt çıkar. https://ibrahimsql.tr/en/posts/ev-charging-station-security-en https://ibrahimsql.tr/api/og?title=EV%20Charging%20Stations%3A%20Plain%20Shell%2C%20Complex%20Core EV Charging Stations: Plain Shell, Complex Core Calling an EV charger a 'simple box of electricity' is easy, but these are grid-connected, remotely managed network nodes. A map of the hardware, network, and legal attack surface through OCPP, ISO 15118, Juice Jacking, CVE-2018-17182, and Brokenwire (CVE-2022-0878). https://ibrahimsql.tr/tr/posts/ev-charging-station-security-tr https://ibrahimsql.tr/api/og?title=Elektrikli%20Ara%C3%A7%20%C5%9Earj%20%C4%B0stasyonlar%C4%B1%3A%20D%C4%B1%C5%9F%C4%B1%20Sade%2C%20%C4%B0%C3%A7i%20Karma%C5%9F%C4%B1k Elektrikli Araç Şarj İstasyonları: Dışı Sade, İçi Karmaşık EV şarj istasyonlarına 'basit bir elektrik kutusu' demek kolay; gerçekte şebekeye bağlı, IoT/SCADA ile yönetilen ağ düğümleri. OCPP, ISO 15118, Juice Jacking, CVE-2018-17182 ve Brokenwire (CVE-2022-0878) üzerinden donanım, ağ ve hukuki saldırı yüzeyinin haritası. https://ibrahimsql.tr/en/posts/gaslightctf-2026-biscuit-writeup-en https://ibrahimsql.tr/api/og?title=GaslightCTF%202026%20%E2%80%94%20biscuit%20Writeup GaslightCTF 2026 — biscuit Writeup A voting app mints Biscuit capability tokens from the username you type. The username is pasted straight into Datalog source, so a crafted signup injects a role("admin") fact into a token the server signs for you and unlocks the staff room flag. https://ibrahimsql.tr/tr/posts/gaslightctf-2026-biscuit-writeup-tr https://ibrahimsql.tr/api/og?title=GaslightCTF%202026%20%E2%80%94%20biscuit%20%C3%87%C3%B6z%C3%BCm%C3%BC GaslightCTF 2026 — biscuit Çözümü Bir oylama uygulaması, girdiğin kullanıcı adından Biscuit yetki jetonu üretiyor. Kullanıcı adı doğrudan Datalog kaynağının içine yazılıyor; özenle hazırlanmış bir kayıt, sunucunun senin adına imzaladığı jetona role("admin") gerçeğini enjekte edip personel odasının bayrağını açıyor. https://ibrahimsql.tr/en/posts/gaslightctf-2026-json-warehouse-writeup-en https://ibrahimsql.tr/api/og?title=GaslightCTF%202026%20%E2%80%94%20json_warehouse%20Writeup GaslightCTF 2026 — json_warehouse Writeup An Elysia note-storage app uses a signed identity cookie with the known key hunter2 only when NODE_ENV is development. Reproducing that mode explains how a forged user=1000 cookie impersonates the admin. https://ibrahimsql.tr/tr/posts/gaslightctf-2026-json-warehouse-writeup-tr https://ibrahimsql.tr/api/og?title=GaslightCTF%202026%20%E2%80%94%20json_warehouse%20%C3%87%C3%B6z%C3%BCm%C3%BC GaslightCTF 2026 — json_warehouse Çözümü Elysia not uygulaması, yalnız NODE_ENV development iken bilinen hunter2 anahtarıyla imzalı kimlik çerezi kullanıyor. Bu modu yeniden üretmek, user=1000 çereziyle yönetici kimliğine bürünmeyi açıklıyor. https://ibrahimsql.tr/tr/posts/gocat-ag-araci-part-3-tr https://ibrahimsql.tr/api/og?title=GoCat%203.%20B%C3%B6l%C3%BCm%3A%20G%C3%BCvenlik%20Testinde%20Kullan%C4%B1m GoCat 3. Bölüm: Güvenlik Testinde Kullanım Port tarama, hex çıktısıyla ikili protokolleri okuma ve esnek bir ağ aracının bir sızma testine nasıl oturduğu — nerede bittiği ve gerçek bir tarayıcının nerede başladığı dahil. https://ibrahimsql.tr/en/posts/gocat-network-swiss-army-knife-part-3-en https://ibrahimsql.tr/api/og?title=GoCat%20Part%203%3A%20Using%20It%20in%20Security%20Testing GoCat Part 3: Using It in Security Testing Port scanning, reading binary protocols with hex output, and how a flexible network tool fits into a penetration test — including where it stops and a real scanner begins. https://ibrahimsql.tr/en/posts/gpn-ctf-2026-secure-secretpickle-writeup-en https://ibrahimsql.tr/api/og?title=GPN%20CTF%202026%20%E2%80%94%20Secure%20Secretpickle%20Writeup GPN CTF 2026 — Secure Secretpickle Writeup Pickle RCE is sandboxed and the client HTML is sanitized, so the flag comes from the admin bot instead: it visits any URL you hand it, including file:///flag.txt, and returns the screenshot. https://ibrahimsql.tr/tr/posts/gpn-ctf-2026-secure-secretpickle-writeup-tr https://ibrahimsql.tr/api/og?title=GPN%20CTF%202026%20%E2%80%94%20Secure%20Secretpickle%20%C3%87%C3%B6z%C3%BCm%C3%BC GPN CTF 2026 — Secure Secretpickle Çözümü Pickle RCE sandbox'a hapsedilmiş, istemci HTML'i de temizlenmiş; bayrak yine de sızıyor çünkü admin bot verdiğin her URL'i, file:///flag.txt dahil, ziyaret edip ekran görüntüsünü geri veriyor. https://ibrahimsql.tr/en/posts/idor-bola-test-plan-en https://ibrahimsql.tr/api/og?title=IDOR%20and%20BOLA%20Test%20Plan%3A%20How%20Multi-Session%20Authorization%20Testing%20Works IDOR and BOLA Test Plan: How Multi-Session Authorization Testing Works Reproduce an IDOR locally, compare owner, peer and tenant access, avoid status-code false positives, and verify the server-side policy fix. https://ibrahimsql.tr/tr/posts/idor-bola-test-plani-tr https://ibrahimsql.tr/api/og?title=IDOR%20ve%20BOLA%20Test%20Plan%C4%B1%3A%20%C3%87ok%20Oturumlu%20Yetki%20Testi%20Nas%C4%B1l%20Yap%C4%B1l%C4%B1r IDOR ve BOLA Test Planı: Çok Oturumlu Yetki Testi Nasıl Yapılır Yerel bir IDOR lab'ında sahip, başka kullanıcı ve tenant erişimini karşılaştırın; HTTP koduyla yetinmeden açığı ve sunucu tarafındaki düzeltmeyi doğrulayın. https://ibrahimsql.tr/en/posts/knightctf-2026-post-exploitation-writeup-en https://ibrahimsql.tr/api/og?title=KnightCTF%202026%20%E2%80%94%20Post_Exploitation%20Writeup KnightCTF 2026 — Post_Exploitation Writeup A noisy capture with one loud port scan hiding the real story. Filtering the noise exposes a WordPress Social Warfare exploit, the HTTP port the attacker served the payload from, and the reverse shell that called home — exactly the two ports the flag wants. https://ibrahimsql.tr/tr/posts/knightctf-2026-post-exploitation-writeup-tr https://ibrahimsql.tr/api/og?title=KnightCTF%202026%20%E2%80%94%20Post_Exploitation%20%C3%87%C3%B6z%C3%BCm%C3%BC KnightCTF 2026 — Post_Exploitation Çözümü Gürültülü bir kayıtta gerçek hikayeyi saklayan tek bir yüksek sesli port taraması var. Gürültüyü ayıklayınca bir WordPress Social Warfare istismarı, saldırganın payload'u sunduğu HTTP portu ve eve dönen reverse shell ortaya çıkıyor — bayrağın istediği tam olarak iki port. https://ibrahimsql.tr/en/posts/knightctf-2026-reconnaissance-writeup-en https://ibrahimsql.tr/api/og?title=KnightCTF%202026%20%E2%80%94%20Reconnaissance%20Writeup KnightCTF 2026 — Reconnaissance Writeup A full 65535-port TCP SYN sweep from 192.168.1.104 against 192.168.1.102: classify every response into SYN-ACK (open) versus RST (closed) and the target exposes exactly two open ports. https://ibrahimsql.tr/tr/posts/knightctf-2026-reconnaissance-writeup-tr https://ibrahimsql.tr/api/og?title=KnightCTF%202026%20%E2%80%94%20Reconnaissance%20Writeup KnightCTF 2026 — Reconnaissance Writeup 192.168.1.104'ten 192.168.1.102'ye tam 65535 portluk TCP SYN taraması: her yanıtı SYN-ACK (açık) ve RST (kapalı) olarak sınıflandır; hedef tam olarak iki açık port sunuyor. https://ibrahimsql.tr/en/posts/kubstu-2026-silence-in-verona-writeup-en https://ibrahimsql.tr/api/og?title=KubSTU%20CTF%202026%20Spring%20%E2%80%94%20Silence%20in%20Verona%20Writeup KubSTU CTF 2026 Spring — Silence in Verona Writeup A Cisco Packet Tracer .pkt file with no magic header and an encrypted body holds a hidden Shakespeare Programming Language program; decrypt the container, find Borring novel.txt, run it, and recover the master key. https://ibrahimsql.tr/tr/posts/kubstu-2026-silence-in-verona-writeup-tr https://ibrahimsql.tr/api/og?title=KubSTU%20CTF%202026%20Spring%20%E2%80%94%20Silence%20in%20Verona%20Writeup KubSTU CTF 2026 Spring — Silence in Verona Writeup Magic header'ı olmayan, gövdesi şifreli bir Cisco Packet Tracer .pkt dosyası gizli bir Shakespeare Programming Language programı barındırıyor; konteyneri çöz, Borring novel.txt'yi bul, çalıştır ve master key'i kurtar. https://ibrahimsql.tr/en/posts/l3akctf-2026-catvault-part-1-writeup-en https://ibrahimsql.tr/api/og?title=L3akCTF%202026%20%E2%80%94%20catvault%20part%201%20Writeup L3akCTF 2026 — catvault part 1 Writeup A vault that only lets you read your own secrets, until the settings endpoint lets you overwrite the session user_id and the vault query filters on the wrong column. https://ibrahimsql.tr/tr/posts/l3akctf-2026-catvault-part-1-writeup-tr https://ibrahimsql.tr/api/og?title=L3akCTF%202026%20%E2%80%94%20catvault%20part%201%20%C3%87%C3%B6z%C3%BCm%C3%BC L3akCTF 2026 — catvault part 1 Çözümü Yalnızca kendi sırlarını okuttuğunu iddia eden bir kasa; ta ki settings uç noktası oturumdaki user_id'yi ezmeye ve vault sorgusu yanlış kolona göre filtrelemeye izin verene kadar. https://ibrahimsql.tr/en/posts/m0lecon-2026-insecure-vault-2-writeup-en https://ibrahimsql.tr/api/og?title=m0leCon%202026%20%E2%80%94%20In%20(Secure)%20Vault%202%20Writeup m0leCon 2026 — In (Secure) Vault 2 Writeup A .NET 8 WPF vault app guards its gate with a client-side CheckPassword: the ptm flag is split into leet fragments verified with MD5, SHA-256, base64 and base32, then reassembled by decompiling the binary. https://ibrahimsql.tr/tr/posts/m0lecon-2026-insecure-vault-2-writeup-tr https://ibrahimsql.tr/api/og?title=m0leCon%202026%20%E2%80%94%20In%20(Secure)%20Vault%202%20%C3%87%C3%B6z%C3%BCm%C3%BC m0leCon 2026 — In (Secure) Vault 2 Çözümü Bir .NET 8 WPF kasa uygulaması kapısını istemci tarafında CheckPassword ile koruyor: ptm bayrağı MD5, SHA-256, base64 ve base32 ile doğrulanan leet parçalara bölünmüş, ikili dosya decompile edilerek birleştiriliyor. https://ibrahimsql.tr/en/posts/ndias-2026-gate-to-the-past-writeup-en https://ibrahimsql.tr/api/og?title=NDIAS%20Automotive%2FIoT%20CTF%202026%20%E2%80%94%20Gate%20to%20the%20Past%20Writeup NDIAS Automotive/IoT CTF 2026 — Gate to the Past Writeup A network-forensics write-up of an SSHv2 capture associated with Debian's historical OpenSSL PRNG flaw. It explains the recorded Diffie–Hellman candidate and packet-level key checks while stating that the capture and candidate-search code are unavailable for independent reproduction. https://ibrahimsql.tr/tr/posts/ndias-2026-gate-to-the-past-writeup-tr https://ibrahimsql.tr/api/og?title=NDIAS%20Automotive%2FIoT%20CTF%202026%20%E2%80%94%20Gate%20to%20the%20Past%20Writeup NDIAS Automotive/IoT CTF 2026 — Gate to the Past Writeup Debian'ın tarihsel OpenSSL PRNG hatasıyla ilişkilendirilen bir SSHv2 yakalamasının network-forensics incelemesi. Kaydedilmiş Diffie–Hellman adayı ve paket düzeyi anahtar kontrollerini açıklar; bağımsız tekrar için pcap ile aday arama kodunun bulunmadığını belirtir. https://ibrahimsql.tr/en/posts/newyear-2026-exfill-writeup-en https://ibrahimsql.tr/api/og?title=NewYear%202026%20%E2%80%94%20exFill%20Writeup NewYear 2026 — exFill Writeup A packet capture of an intrusion against a vsftpd 2.3.4 server. The attacker triggers the smiley backdoor, gains a root shell, then exfiltrates a JPEG as base64 over a reverse shell. Reassembly recovers the file and a printable flag string from its bytes. https://ibrahimsql.tr/tr/posts/newyear-2026-exfill-writeup-tr https://ibrahimsql.tr/api/og?title=NewYear%202026%20%E2%80%94%20exFill%20%C3%87%C3%B6z%C3%BCm%20Yaz%C4%B1s%C4%B1 NewYear 2026 — exFill Çözüm Yazısı vsftpd 2.3.4 çalıştıran bir sunucuya yapılan saldırının paket yakalaması. Saldırgan smiley arka kapısını tetikliyor, root kabuğu alıyor ve bir JPEG'i reverse shell üzerinden base64 olarak dışarı sızdırıyor. Akış yeniden birleştirildiğinde dosya ve baytları içinde yazdırılabilir bir bayrak dizisi bulunuyor. https://ibrahimsql.tr/tr/posts/oscp-pen200-02-bilgi-toplama https://ibrahimsql.tr/api/og?title=PEN-200%20Serisi%2C%20B%C3%B6l%C3%BCm%202%3A%20Pasif%20ve%20Aktif%20Bilgi%20Toplama PEN-200 Serisi, Bölüm 2: Pasif ve Aktif Bilgi Toplama Hedefe paket göndermeden ne öğrenebileceğin, HTTP başlıklarından sızanlar, gerçek bir hedefe karşı doğrulanmış nmap servis parmak izi ve eresus-ctf-lab üzerinde canlı recon örneği. https://ibrahimsql.tr/en/posts/oscp-pen200-02-information-gathering https://ibrahimsql.tr/api/og?title=PEN-200%20Series%2C%20Part%202%3A%20Passive%20and%20Active%20Information%20Gathering PEN-200 Series, Part 2: Passive and Active Information Gathering What you can learn without sending a packet to the target, what leaks through HTTP headers, a verified nmap service fingerprint against a real target, and a live recon example run against eresus-ctf-lab. https://ibrahimsql.tr/en/posts/pragyan-2026-plumbing-writeup-en https://ibrahimsql.tr/api/og?title=Pragyan%202026%20%E2%80%94%20Plumbing%20Writeup Pragyan 2026 — Plumbing Writeup A shipped Docker image whose final container looks spotless. Peeling back the OCI layers exposes the build history, a deleted state file hidden behind a whiteout, and an original output the developer thought they overwrote. Two leaks invert a custom block cipher and hand back the flag. https://ibrahimsql.tr/tr/posts/pragyan-2026-plumbing-writeup-tr https://ibrahimsql.tr/api/og?title=Pragyan%202026%20%E2%80%94%20Plumbing%20%C3%87%C3%B6z%C3%BCm%20Yaz%C4%B1s%C4%B1 Pragyan 2026 — Plumbing Çözüm Yazısı Son hâli tertemiz görünen, çoktan gönderilmiş bir Docker imajı. OCI katmanlarını soymak yapı geçmişini, bir whiteout arkasına gizlenmiş silinmiş bir durum dosyasını ve geliştiricinin üzerine yazdığını sandığı özgün çıktıyı ortaya çıkarıyor. İki sızıntı özel bir blok şifresini tersine çevirip bayrağı geri veriyor. https://ibrahimsql.tr/en/posts/sekai-2026-filtered-reality-writeup-en https://ibrahimsql.tr/api/og?title=SekaiCTF%202026%20%E2%80%94%20Filtered%20Reality%20Writeup SekaiCTF 2026 — Filtered Reality Writeup A WordPress bureau where a subscriber spoofs an admin screen to leak a nonce, then a five-stage client-to-server chain ends in a php://filter RCE and a keeper hash length-extension to read the flag. https://ibrahimsql.tr/tr/posts/sekai-2026-filtered-reality-writeup-tr https://ibrahimsql.tr/api/og?title=SekaiCTF%202026%20%E2%80%94%20Filtered%20Reality%20%C3%87%C3%B6z%C3%BCm%C3%BC SekaiCTF 2026 — Filtered Reality Çözümü Bir abonenin admin ekranını taklit ederek nonce sızdırdığı bir WordPress kayıt bürosu; beş aşamalı istemciden sunucuya zincir php://filter RCE ve keeper hash uzatma saldırısıyla bayrağa ulaşıyor. https://ibrahimsql.tr/en/posts/squ1rrel-2026-rails-writeup-en https://ibrahimsql.tr/api/og?title=squ1rrel%20CTF%202026%20%E2%80%94%20rails%20Writeup squ1rrel CTF 2026 — rails Writeup Three small Rails mistakes chain together: an attacker-controlled constantize leaks the JWT signing secret, the admin middleware accepts any HS256 token signed with it, and an array query parameter defeats the reserved-post check to return the flag. https://ibrahimsql.tr/tr/posts/squ1rrel-2026-rails-writeup-tr https://ibrahimsql.tr/api/og?title=squ1rrel%20CTF%202026%20%E2%80%94%20rails%20Writeup squ1rrel CTF 2026 — rails Writeup Üç küçük Rails hatası birbirine bağlanıyor: saldırgan kontrolündeki constantize JWT imzalama anahtarını sızdırıyor, admin middleware o anahtarla imzalanmış herhangi bir HS256 token'ı kabul ediyor ve bir dizi query parametresi reserved-post kontrolünü atlayarak flag'i döndürüyor. https://ibrahimsql.tr/en/posts/tjctf-2026-loud-packets-writeup-en https://ibrahimsql.tr/api/og?title=TJCTF%202026%20%E2%80%94%20loud-packets%20Writeup TJCTF 2026 — loud-packets Writeup A pcap described as a Bluetooth transfer reportedly carries a WAV across 459 UDP packets. The proposed solve reads a Hellschreiber-like bitmap from its spectrogram; capture measurements and flag below are original notes, not independently reproduced. https://ibrahimsql.tr/tr/posts/tjctf-2026-loud-packets-writeup-tr https://ibrahimsql.tr/api/og?title=TJCTF%202026%20%E2%80%94%20loud-packets%20%C3%87%C3%B6z%C3%BCm%20Yaz%C4%B1s%C4%B1 TJCTF 2026 — loud-packets Çözüm Yazısı Özgün notlarda Bluetooth aktarımı diye sunulan bir pcap'in 459 UDP paketi içinde WAV taşıdığı raporlanıyor. Önerilen çözüm, spektrogramı Hellschreiber benzeri bir bitmap olarak okuyor; ölçümler ve bayrak bu turda yeniden doğrulanmadı. https://ibrahimsql.tr/en/posts/tracebash-2026-the-silent-echo-writeup-en https://ibrahimsql.tr/api/og?title=TraceBash%202026%20%E2%80%94%20The%20Silent%20Echo%20Writeup TraceBash 2026 — The Silent Echo Writeup A tiny capture that looks like DNS noise, a decoy ICMP flood and a fake SSH session. The real message is smuggled in two header fields nobody reads: the IP identification field of ICMP echoes and the TCP window size of an HTTP flow. https://ibrahimsql.tr/tr/posts/tracebash-2026-the-silent-echo-writeup-tr https://ibrahimsql.tr/api/og?title=TraceBash%202026%20%E2%80%94%20The%20Silent%20Echo%20%C3%87%C3%B6z%C3%BCm%20Yaz%C4%B1s%C4%B1 TraceBash 2026 — The Silent Echo Çözüm Yazısı DNS gürültüsü, aldatıcı bir ICMP seli ve sahte bir SSH oturumu gibi görünen küçük bir yakalama. Gerçek mesaj kimsenin bakmadığı iki başlık alanında gizli: ICMP yankılarının IP kimlik alanı ve bir HTTP akışının TCP pencere boyutu. https://ibrahimsql.tr/en/posts/tracebash-2026-trusted-rules-writeup-en https://ibrahimsql.tr/api/og?title=TraceBash%202026%20%E2%80%94%20Trusted%20Rules%20Writeup TraceBash 2026 — Trusted Rules Writeup Trusted Types and a regex sanitizer bypassed in a Flask notes app: an HTML-entity-encoded iframe srcdoc runs inline script under CSP, reads the admin-only /admin/flag, and exfiltrates it via top-level navigation. https://ibrahimsql.tr/tr/posts/tracebash-2026-trusted-rules-writeup-tr https://ibrahimsql.tr/api/og?title=TraceBash%202026%20%E2%80%94%20Trusted%20Rules%20%C3%87%C3%B6z%C3%BCm%C3%BC TraceBash 2026 — Trusted Rules Çözümü Bir Flask not uygulamasında Trusted Types ve regex sanitizer atlatılıyor: HTML entity ile kodlanmış iframe srcdoc, CSP altında satır içi betik çalıştırıp yalnızca admine ait /admin/flag'i okuyor ve onu üst düzey yönlendirme ile sızdırıyor. https://ibrahimsql.tr/en/posts/traffic-light-hacking-en https://ibrahimsql.tr/api/og?title=Hacking%20Traffic%20Lights%3A%20The%20City's%20Invisible%20State%20Machine Hacking Traffic Lights: The City's Invisible State Machine Traffic lights are an OT system bound to the physical world: intersection controllers that make local decisions and network nodes that connect to a central system over NTCIP/SNMP. A map of the attack surface through default SNMP credentials, the safety chain, and Cerrudo's 2014 research. https://ibrahimsql.tr/tr/posts/traffic-light-hacking-tr https://ibrahimsql.tr/api/og?title=Trafik%20I%C5%9F%C4%B1klar%C4%B1n%C4%B1%20Hacklemek%3A%20%C5%9Eehrin%20G%C3%B6r%C3%BCnmeyen%20Durum%20Makinesi Trafik Işıklarını Hacklemek: Şehrin Görünmeyen Durum Makinesi Trafik ışıkları fiziksel dünyaya bağlı bir OT sistemidir: kavşakta karar veren kontrolörler, NTCIP/SNMP üzerinden merkeze bağlanan ağ düğümleri. Varsayılan SNMP kimlik bilgileri, güvenlik zinciri ve Cerrudo'nun 2014 araştırması üzerinden saldırı yüzeyinin haritası. https://ibrahimsql.tr/en/posts/universal-2026-carrier-lock-writeup-en https://ibrahimsql.tr/api/og?title=Universal%202026%20%E2%80%94%20Carrier%20Lock%20Writeup Universal 2026 — Carrier Lock Writeup Frame a recorded satellite downlink using CCSDS sync markers, reverse the legacy eight-stage randomizer, and reconstruct a fragmented message on APID 250 with packet-length and sequence checks. https://ibrahimsql.tr/tr/posts/universal-2026-carrier-lock-writeup-tr https://ibrahimsql.tr/api/og?title=Universal%202026%20%E2%80%94%20Carrier%20Lock%20%C3%87%C3%B6z%C3%BCm%20Yaz%C4%B1s%C4%B1 Universal 2026 — Carrier Lock Çözüm Yazısı Kayıtlı uydu verisini CCSDS sync marker ile çerçeveleme, sekiz aşamalı eski rastgeleleştiriciyi tersine çevirme ve APID 250 mesajını uzunluk/sıra denetimiyle birleştirme. https://ibrahimsql.tr/en/posts/uoftctf-2026-baby-exfil-writeup-en https://ibrahimsql.tr/api/og?title=UofTCTF%202026%20%E2%80%94%20Baby%20Exfil%20Writeup UofTCTF 2026 — Baby Exfil Writeup A packet capture of a data-exfiltration implant that steals images off a Windows desktop, XORs them with a hard-coded key and POSTs them as hex. The served malware ships the key, so the whole capture decrypts back to the stolen files. https://ibrahimsql.tr/tr/posts/uoftctf-2026-baby-exfil-writeup-tr https://ibrahimsql.tr/api/og?title=UofTCTF%202026%20%E2%80%94%20Baby%20Exfil%20%C3%87%C3%B6z%C3%BCm%20Yaz%C4%B1s%C4%B1 UofTCTF 2026 — Baby Exfil Çözüm Yazısı Bir Windows masaüstünden resim çalan, sabit anahtarla XOR'layıp hex olarak POST eden bir sızdırma implantının pcap'i. Sunucudan servis edilen zararlı, anahtarı da beraberinde veriyor; tüm yakalama çalınan dosyalara geri çözülüyor. https://ibrahimsql.tr/en/posts/uoftctf-2026-no-quotes-writeup-en https://ibrahimsql.tr/api/og?title=UofTCTF%202026%20%E2%80%94%20No%20Quotes%20Writeup UofTCTF 2026 — No Quotes Writeup A two-character quote ban, escaping the closing quote with a backslash, a hex-encoded UNION injection, and an SSTI in /home via render_template_string that ends in RCE. https://ibrahimsql.tr/tr/posts/uoftctf-2026-no-quotes-writeup-tr https://ibrahimsql.tr/api/og?title=UofTCTF%202026%20%E2%80%94%20No%20Quotes%20%C3%87%C3%B6z%C3%BCm%C3%BC UofTCTF 2026 — No Quotes Çözümü Kısa özet: iki karakterlik tırnak yasağı, backslash ile kapanış tırnağını kaçırma, hex'li UNION enjeksiyonu ve /home'deki render_template_string SSTI'siyle RCE. https://ibrahimsql.tr/en/posts/uoftctf-2026-pasteboard-writeup-en https://ibrahimsql.tr/api/og?title=UofTCTF%202026%20%E2%80%94%20Pasteboard%20Writeup UofTCTF 2026 — Pasteboard Writeup DOMPurify is fine — the bug is a raw server-side sink plus DOM clobbering: I hijack window.renderConfig to force a throw, then use window.errorReporter.path.value to load an arbitrary script under strict-dynamic and exfiltrate the bot's cookie. https://ibrahimsql.tr/tr/posts/uoftctf-2026-pasteboard-writeup-tr https://ibrahimsql.tr/api/og?title=UofTCTF%202026%20%E2%80%94%20Pasteboard%20%C3%87%C3%B6z%C3%BCm%C3%BC UofTCTF 2026 — Pasteboard Çözümü DOMPurify korurken zafiyet sunucu tarafındaki raw sink ve DOM clobbering'te: window.renderConfig'i ele geçirip throw tetikliyor, window.errorReporter.path.value ile strict-dynamic altında keyfi script yükleyip botun çerezini exfil ediyorum. https://ibrahimsql.tr/tr/posts/gocat-ag-araci-part-2-tr https://ibrahimsql.tr/api/og?title=GoCat%202.%20B%C3%B6l%C3%BCm%3A%20TLS%2C%20Proxy%20ve%20Etkile%C5%9Fimli%20Mod GoCat 2. Bölüm: TLS, Proxy ve Etkileşimli Mod Ham boruyu şifreleme ve yönlendirmeyle sarmak: GoCat ile TLS, proxy üzerinden tünelleme, etkileşimli kolaylıklar ve aynı anda birden fazla port dinleme. https://ibrahimsql.tr/en/posts/gocat-network-swiss-army-knife-part-2-en https://ibrahimsql.tr/api/og?title=GoCat%20Part%202%3A%20TLS%2C%20Proxies%2C%20and%20Interactive%20Mode GoCat Part 2: TLS, Proxies, and Interactive Mode Wrapping the raw pipe in encryption and routing: TLS with GoCat, tunneling through a proxy, interactive conveniences, and listening on several ports at once. https://ibrahimsql.tr/tr/posts/oscp-pen200-01-not-tutma-rapor-yazimi https://ibrahimsql.tr/api/og?title=PEN-200%20Serisi%2C%20B%C3%B6l%C3%BCm%201%3A%20Puan%20Kazand%C4%B1ran%20Not%20Tutma%20ve%20Rapor%20Yaz%C4%B1m%C4%B1 PEN-200 Serisi, Bölüm 1: Puan Kazandıran Not Tutma ve Rapor Yazımı Test sırasında ne kaydedilmeli, 24 saat boyunca dayanan üç not tutma düzeni, şimdi doğrulayabileceğin bir terminal loglama komutu ve OSCP+ belgelendirme kurallarının tarif ettiği tam rapor yapısı. https://ibrahimsql.tr/en/posts/oscp-pen200-01-note-taking-reporting https://ibrahimsql.tr/api/og?title=PEN-200%20Series%2C%20Part%201%3A%20Note-Taking%20and%20the%20Report%20That%20Actually%20Scores%20Points PEN-200 Series, Part 1: Note-Taking and the Report That Actually Scores Points What to capture during a test, three note-taking setups that hold up for 24 hours straight, a terminal-logging command you can verify right now, and the exact report structure the OSCP+ documentation requirements describe. https://ibrahimsql.tr/tr/posts/eresus-guard-neden-gelistirdik-tr https://ibrahimsql.tr/api/og?title=Eresus%20Guard'%C4%B1%20Neden%20Geli%C5%9Ftirdik%3A%20G%C3%BCr%C3%BClt%C3%BCs%C3%BCz%20DAST%20ve%20Yetki%20Testi Eresus Guard'ı Neden Geliştirdik: Gürültüsüz DAST ve Yetki Testi DAST bulgusunu nasıl doğrularsınız? OAST callback'ini ilişkilendirin, kullanıcı bağlamlarını karşılaştırın ve başarısız taramayı temiz sonuçtan ayırın. https://ibrahimsql.tr/tr/posts/gocat-ag-araci-part-1-tr https://ibrahimsql.tr/api/og?title=GoCat%201.%20B%C3%B6l%C3%BCm%3A%20Go%20ile%20Modern%20Bir%20netcat%20Alternatifi GoCat 1. Bölüm: Go ile Modern Bir netcat Alternatifi netcat neden eskidi, Go bir ağ aracına ne katıyor ve GoCat'in temel iş akışları: dinleme, bağlanma, TCP ile UDP ve dosya transferi. https://ibrahimsql.tr/en/posts/gocat-network-swiss-army-knife-part-1-en https://ibrahimsql.tr/api/og?title=GoCat%20Part%201%3A%20A%20Modern%20netcat%20Alternative%20in%20Go GoCat Part 1: A Modern netcat Alternative in Go Why netcat's age shows, what Go buys a network tool, and the core workflows of GoCat: listening, connecting, TCP versus UDP, and moving files. https://ibrahimsql.tr/tr/posts/nosql-injection-bolum-1-operator-enjeksiyonu https://ibrahimsql.tr/api/og?title=NoSQL%20Injection%2C%20B%C3%B6l%C3%BCm%201%3A%20MongoDB%20API'lerinde%20Operat%C3%B6r%20Enjeksiyonu NoSQL Injection, Bölüm 1: MongoDB API'lerinde Operatör Enjeksiyonu Gerçek bir Express + MongoDB sürücüsü lab'ında $ne, $gt, $in ve $regex ile login bypass, şifre sıfırlama üzerinden hesap ele geçirme ve kör şifre çıkarma. Express 5'in açığı neden yarım kapattığı ve Mongoose 9'un varsayılan ayarlarla neden hâlâ açık olduğu da içinde. https://ibrahimsql.tr/en/posts/nosql-injection-part-1-operator-injection https://ibrahimsql.tr/api/og?title=NoSQL%20Injection%2C%20Part%201%3A%20Operator%20Injection%20in%20MongoDB%20APIs NoSQL Injection, Part 1: Operator Injection in MongoDB APIs Login bypass, password-reset takeover, and blind password extraction with $ne, $gt, $in, and $regex against a real Express + MongoDB driver lab. Includes why Express 5 only closes half the hole and why Mongoose 9 is still injectable by default. https://ibrahimsql.tr/en/posts/oscp-preparation-guide https://ibrahimsql.tr/api/og?title=OSCP%2B%20Preparation%20Guide%20for%202026%3A%20Exam%20Format%2C%20a%2012-Week%20Plan%2C%20and%20an%20Exam-Day%20Playbook OSCP+ Preparation Guide for 2026: Exam Format, a 12-Week Plan, and an Exam-Day Playbook How the OSCP+ exam is scored, what is and is not allowed, a 12-week study plan built around PEN-200 and Proving Grounds, the enumeration and Active Directory workflow that wins points, and how to write a report that passes. https://ibrahimsql.tr/tr/posts/oscp-sinavi-hazirlik-rehberi https://ibrahimsql.tr/api/og?title=2026%20OSCP%2B%20Haz%C4%B1rl%C4%B1k%20Rehberi%3A%20S%C4%B1nav%20Format%C4%B1%2C%2012%20Haftal%C4%B1k%20Plan%20ve%20S%C4%B1nav%20G%C3%BCn%C3%BC%20Ak%C4%B1%C5%9F%C4%B1 2026 OSCP+ Hazırlık Rehberi: Sınav Formatı, 12 Haftalık Plan ve Sınav Günü Akışı OSCP+ sınavının puanlaması, izin verilen ve verilmeyen araçlar, PEN-200 ve Proving Grounds etrafında kurulu 12 haftalık plan, puan kazandıran enumerasyon ve Active Directory akışı ve geçer rapor nasıl yazılır. https://ibrahimsql.tr/en/posts/why-we-built-eresus-guard-en https://ibrahimsql.tr/api/og?title=Why%20We%20Built%20Eresus%20Guard%3A%20DAST%20With%20Less%20Noise%20and%20Real%20Authorization%20Testing Why We Built Eresus Guard: DAST With Less Noise and Real Authorization Testing How to evaluate DAST evidence: correlate OAST callbacks, compare authorization contexts, and separate a scanner failure from a clean result. https://ibrahimsql.tr/en/posts/xss-lab-guide https://ibrahimsql.tr/api/og?title=XSS%20by%20Context%3A%20A%20Browser-Verified%20Lab%20for%20Five%20Sinks%2C%20Escaping%2C%20and%20CSP XSS by Context: A Browser-Verified Lab for Five Sinks, Escaping, and CSP A small vulnerable server with five XSS contexts, tested in a real browser: which payloads fire, why innerHTML ignores script tags, what context-aware escaping fixes, and the one case a nonce-based CSP does not stop. https://ibrahimsql.tr/tr/posts/xss-lab-rehberi https://ibrahimsql.tr/api/og?title=Ba%C4%9Flama%20G%C3%B6re%20XSS%3A%20Be%C5%9F%20Sink%2C%20Escaping%20ve%20CSP%20i%C3%A7in%20Taray%C4%B1c%C4%B1da%20Do%C4%9Frulanm%C4%B1%C5%9F%20Bir%20Lab Bağlama Göre XSS: Beş Sink, Escaping ve CSP için Tarayıcıda Doğrulanmış Bir Lab Beş XSS bağlamı olan küçük bir zafiyetli sunucu, gerçek tarayıcıda test edildi: hangi payload çalışır, innerHTML neden script etiketini yok sayar, bağlama duyarlı escaping neyi düzeltir ve nonce tabanlı CSP'nin durduramadığı tek durum. https://ibrahimsql.tr/en/posts/ai-cli-statusline-rehberi-en https://ibrahimsql.tr/api/og?title=Statusline%20in%20AI%20CLI%20Tools%3A%20Model%2C%20Limit%2C%20and%20Context%20in%20One%20Line Statusline in AI CLI Tools: Model, Limit, and Context in One Line Documented statusline payloads for Claude Code and agy, Codex's built-in line, jq examples that do not treat missing fields as zero, and the quota/context/cost distinction. https://ibrahimsql.tr/tr/posts/ai-cli-statusline-rehberi https://ibrahimsql.tr/api/og?title=AI%20CLI%20Ara%C3%A7lar%C4%B1nda%20Statusline%3A%20Tek%20Sat%C4%B1rda%20Model%2C%20Limit%20ve%20Context AI CLI Araçlarında Statusline: Tek Satırda Model, Limit ve Context Claude Code ve agy için belgelenmiş statusline payload'ları, Codex'in yerleşik satırı, eksik alanları sıfır saymayan jq örnekleri ve quota/context/maliyet ayrımı. https://ibrahimsql.tr/en/posts/android-pentesting-checklist-en https://ibrahimsql.tr/api/og?title=Android%20Pentest%20and%20Security%20Architecture%3A%202026%20Field%20Manual%20and%20Source%20Code%20Analysis Android Pentest and Security Architecture: 2026 Field Manual and Source Code Analysis A deep architectural analysis of Android application security: Binder IPC, Keystore/Keymint TEE integration, exported components, WebView exploits, JNI/NDK analysis, and Play Integrity mechanisms under 2026 standards. https://ibrahimsql.tr/tr/posts/android-pentesting-checklist-tr https://ibrahimsql.tr/api/og?title=Android%20Pentest%20ve%20G%C3%BCvenlik%20Mimarisi%3A%202026%20Saha%20Rehberi%20ve%20Kaynak%20Kod%20Analizi Android Pentest ve Güvenlik Mimarisi: 2026 Saha Rehberi ve Kaynak Kod Analizi Android güvenlik modeli, Binder IPC, Keystore/Keymint TEE entegrasyonu, exported bileşenler, WebView zafiyetleri, JNI/NDK analizi ve Play Integrity mekanizmalarının 2026 standartlarında derinlemesine teknik analizi. https://ibrahimsql.tr/en/posts/anti-debugging-noobs-en https://ibrahimsql.tr/api/og?title=Anti-Debugging%20for%20Noobs%2C%20Part%201%3A%20How%20a%20Program%20Notices%20the%20Debugger Anti-Debugging for Noobs, Part 1: How a Program Notices the Debugger First principles of anti-debugging on Linux: the one-tracer rule, ptrace self-trace, TracerPid in /proc, parent checks, timing gaps and 0xCC breakpoint scanning, plus how analysts answer each check. https://ibrahimsql.tr/tr/posts/anti-debugging-noobs-tr https://ibrahimsql.tr/api/og?title=Yeni%20Ba%C5%9Flayanlar%20i%C3%A7in%20Anti-Debugging%2C%20B%C3%B6l%C3%BCm%201%3A%20Program%20Debugger'%C4%B1%20Nas%C4%B1l%20Fark%20Eder Yeni Başlayanlar için Anti-Debugging, Bölüm 1: Program Debugger'ı Nasıl Fark Eder Linux'ta anti-debugging'in temelleri: tek tracer kuralı, ptrace ile kendini izleme, /proc içinde TracerPid, ebeveyn kontrolü, zamanlama ölçümü ve 0xCC breakpoint taraması; artı analistlerin her kontrole verdiği yanıtlar. https://ibrahimsql.tr/en/posts/claude-code-co-authored-by-kaldirma-en https://ibrahimsql.tr/api/og?title=Removing%20the%20Co-Authored-By%20Signature%20in%20Claude%20Code Removing the Co-Authored-By Signature in Claude Code Two ways to remove the 'Co-Authored-By' / 'Generated with' lines Claude Code adds to commits and pull requests: settings.json attribution and a commit-msg hook. https://ibrahimsql.tr/tr/posts/claude-code-co-authored-by-kaldirma https://ibrahimsql.tr/api/og?title=Claude%20Code'da%20Co-Authored-By%20%C4%B0mzas%C4%B1n%C4%B1%20Kald%C4%B1rmak Claude Code'da Co-Authored-By İmzasını Kaldırmak Claude Code'un commit ve PR'lara eklediği 'Co-Authored-By' / 'Generated with' satırlarını iki yolla kaldırmak: settings.json attribution ve commit-msg hook'u. https://ibrahimsql.tr/en/posts/en-cybersecurity-risk-model https://ibrahimsql.tr/api/og?title=A%20Risk%20Model%20for%20Cyber%20Security%3A%20What%20Should%20You%20Protect%20First%3F A Risk Model for Cyber Security: What Should You Protect First? A practical approach to moving security work out of random tool-trying and into a measurable risk model. https://ibrahimsql.tr/en/posts/en-nextjs-secure-app-structure https://ibrahimsql.tr/api/og?title=Secure%20Next.js%20Application%20Structure%3A%20A%20Practical%20Checklist%20for%20Small%20Teams Secure Next.js Application Structure: A Practical Checklist for Small Teams An actionable guide to hardening routes, environment variables, form security, and SEO foundations in a Next.js project at the same time. https://ibrahimsql.tr/en/posts/htb-cap-writeup-en https://ibrahimsql.tr/api/og?title=HackTheBox%20Cap%20Writeup HackTheBox Cap Writeup HTB Cap: a broken access control at /data/0 leaks a PCAP, FTP credentials, SSH password reuse, and a Python cap_setuid capability chain to root. https://ibrahimsql.tr/tr/posts/htb-cap-writeup https://ibrahimsql.tr/api/og?title=HackTheBox%20Cap%20Writeup HackTheBox Cap Writeup HTB Cap: /data/0 erişim kontrolü hatasıyla PCAP sızıntısı, FTP kimlik bilgileri, SSH parola tekrarı ve Python cap_setuid yetkisiyle root zinciri. https://ibrahimsql.tr/en/posts/htb-code-python-sandbox-en https://ibrahimsql.tr/api/og?title=HTB%20Code%3A%20Python%20Sandbox%20Escape%20and%20Backy%20Sudo%20Bypass HTB Code: Python Sandbox Escape and Backy Sudo Bypass Code box: string-based blocklist bypass, subprocess.Popen via the object graph, bcrypt SQLite passwords, and root through a backy sudo JSON path traversal. https://ibrahimsql.tr/tr/posts/htb-code-python-sandbox https://ibrahimsql.tr/api/og?title=HTB%20Code%3A%20Python%20Sandbox%20Escape%20ve%20Backy%20Sudo%20Bypass HTB Code: Python Sandbox Escape ve Backy Sudo Bypass Code makinesi: string-based blocklist bypass, object graph ile subprocess.Popen, bcrypt SQLite şifreleri ve backy sudo JSON path traversal ile root. https://ibrahimsql.tr/en/posts/htb-facts-idor-traversal-en https://ibrahimsql.tr/api/og?title=HTB%20Facts%3A%20Camaleon%20CMS%20Mass%20Assignment%2C%20Path%20Traversal%2C%20and%20Sudo%20Facter HTB Facts: Camaleon CMS Mass Assignment, Path Traversal, and Sudo Facter Facts box: mass-assignment to admin, Camaleon download_private_file path traversal, an SSH key from a MinIO bucket, and root via a --custom-dir facter rule. https://ibrahimsql.tr/tr/posts/htb-facts-idor-traversal https://ibrahimsql.tr/api/og?title=HTB%20Facts%3A%20Camaleon%20CMS%20Mass%20Assignment%2C%20Path%20Traversal%20ve%20Sudo%20Facter HTB Facts: Camaleon CMS Mass Assignment, Path Traversal ve Sudo Facter Facts makinesi: mass-assignment ile admin yapımı, Camaleon download_private_file path traversal, MinIO bucket'ten SSH anahtarı ve --custom-dir facter ile root. https://ibrahimsql.tr/en/posts/htb-kobold-mcpjam-docker-en https://ibrahimsql.tr/api/og?title=HTB%20Kobold%3A%20MCPJam%20RCE%20and%20an%20Unverified%20PrivateBin%2FArcane%20Chain HTB Kobold: MCPJam RCE and an Unverified PrivateBin/Arcane Chain Kobold lab notes on MCPJam's unauthenticated connect endpoint and a reported PrivateBin/Arcane route. The PrivateBin-to-RCE steps depend on configuration and paths not retained in the evidence. https://ibrahimsql.tr/tr/posts/htb-kobold-mcpjam-docker https://ibrahimsql.tr/api/og?title=HTB%20Kobold%3A%20MCPJam%20RCE%20ve%20Do%C4%9Frulanmam%C4%B1%C5%9F%20PrivateBin%2FArcane%20Zinciri HTB Kobold: MCPJam RCE ve Doğrulanmamış PrivateBin/Arcane Zinciri Kobold lab notları: MCPJam'in kimlik doğrulamasız connect uç noktası ve bildirilen PrivateBin/Arcane yolu. PrivateBin'den RCE'ye geçiş, kanıtta bulunmayan yapılandırma ve path koşullarına bağlı. https://ibrahimsql.tr/en/posts/ios-pentesting-checklist-en https://ibrahimsql.tr/api/og?title=iOS%20Pentesting%20Checklist%3A%20A%20Practical%20Verification%20Pass iOS Pentesting Checklist: A Practical Verification Pass Step-by-step iOS pentest flow: data storage, keychain, ATS, jailbreak detection, SSL pinning, Frida hooks and traffic inspection. https://ibrahimsql.tr/tr/posts/ios-pentesting-checklist-tr https://ibrahimsql.tr/api/og?title=iOS%20Pentest%20Checklist%3A%20Pratik%20Bir%20Do%C4%9Frulama%20Listesi iOS Pentest Checklist: Pratik Bir Doğrulama Listesi iOS uygulamalarını test ederken izlenecek adımlar: veri saklama, keychain, ATS, jailbreak tespiti, Frida ve ağ trafiği analizi. https://ibrahimsql.tr/en/posts/keylogging-linux-rehberi-en https://ibrahimsql.tr/api/og?title=Keylogging%20on%20Linux%2C%20Part%201%3A%20From%20Kernel%20Key%20Handling%20to%20the%20X%20Server Keylogging on Linux, Part 1: From Kernel Key Handling to the X Server How a key press travels through the kernel keyboard driver, the input subsystem, evdev and /dev/input/event nodes, then through the X server input pipeline and XKB keymap, and where loggers hook in. https://ibrahimsql.tr/tr/posts/keylogging-linux-rehberi-tr https://ibrahimsql.tr/api/og?title=Linux'ta%20Keylogging%2C%20B%C3%B6l%C3%BCm%201%3A%20%C3%87ekirdek%20Tu%C5%9F%20%C4%B0%C5%9Flemeden%20X%20Sunucusuna Linux'ta Keylogging, Bölüm 1: Çekirdek Tuş İşlemeden X Sunucusuna Bir tuş vuruşunun çekirdek klavye sürücüsü, input altyapısı, evdev ve /dev/input/event düğümleri üzerinden X sunucusu girdi hattına ve XKB keymap'e nasıl aktığını ve logger'ların nereye bağlandığını inceliyoruz. https://ibrahimsql.tr/en/posts/linux-auth-ui-en https://ibrahimsql.tr/api/og?title=Security%20Architecture%20of%20Authorisation%20and%20Authentication%20UIs%20on%20the%20Linux%20Desktop Security Architecture of Authorisation and Authentication UIs on the Linux Desktop A deep architectural analysis of password prompts and permission dialogs on modern Linux: how Wayland, polkit, PAM, and xdg-desktop-portal isolate credentials and capabilities as of 2026. https://ibrahimsql.tr/tr/posts/linux-auth-ui-tr https://ibrahimsql.tr/api/og?title=Linux%20Masa%C3%BCst%C3%BCnde%20Yetkilendirme%20ve%20Kimlik%20Do%C4%9Frulama%20Aray%C3%BCzlerinin%20G%C3%BCvenlik%20Mimarisi Linux Masaüstünde Yetkilendirme ve Kimlik Doğrulama Arayüzlerinin Güvenlik Mimarisi Parola ve onay pencerelerinin güvenlik sınırları, Wayland, polkit, PAM ve xdg-desktop-portal mimarisinin yetkilendirme ve kimlik doğrulama süreçlerini nasıl yalıttığının 2026 standartlarındaki derin teknik analizi. https://ibrahimsql.tr/tr/posts/modern-linux-ikili-somuru-ve-savunma-2026-tr https://ibrahimsql.tr/api/og?title=Modern%20Linux%20%C4%B0kili%20Bellek%20G%C3%BCvenli%C4%9Fi%3A%20ELF%20Mimarisi%2C%20Derleyici%20Savunmalar%C4%B1%20ve%20ROP%20Mekanikleri Modern Linux İkili Bellek Güvenliği: ELF Mimarisi, Derleyici Savunmaları ve ROP Mekanikleri x86_64 ELF bellek bozulma mekaniklerinin derin teknik analizi: Derleyici korumaları (Canaries, Full RELRO, PIE, Intel CET), AddressSanitizer ile hata triyajı, ROP teorisi ve ikili savunma mühendisliği. https://ibrahimsql.tr/en/posts/prototype-pollution-2025 https://ibrahimsql.tr/api/og?title=Prototype%20Pollution%3A%20Engine%20Internals%2C%20Node.js%20Gadget%20Chains%2C%20and%20Hardening%20Architecture Prototype Pollution: Engine Internals, Node.js Gadget Chains, and Hardening Architecture A deep technical dissection of JavaScript prototype pollution: V8 object shapes, server-side gadget chains in Node.js child_process and template engines, client-side DOM vectors, and strong runtime mitigations. https://ibrahimsql.tr/tr/posts/prototype-pollution-2026-tr https://ibrahimsql.tr/api/og?title=Prototype%20Pollution%3A%20V8%20Motor%20%C4%B0%C3%A7%20Mekanikleri%2C%20Node.js%20Gadget%20Zincirleri%20ve%20Savunma%20Mimarisi Prototype Pollution: V8 Motor İç Mekanikleri, Node.js Gadget Zincirleri ve Savunma Mimarisi JavaScript prototip kirlenmesinin derin teknik analizi: V8 nesne modelleri, child_process ve şablon motorları üzerinden sunucu taraflı RCE zincirleri, istemci taraflı DOM vektörleri ve çalışma zamanı sertleştirme mimarileri. https://ibrahimsql.tr/tr/posts/regresshion-cve-2024-6387-anatomisi https://ibrahimsql.tr/api/og?title=regreSSHion%20Anatomisi%3A%20CVE-2024-6387%20OpenSSH%20Pre-Auth%20RCE%20Derinlemesine%20Analizi regreSSHion Anatomisi: CVE-2024-6387 OpenSSH Pre-Auth RCE Derinlemesine Analizi OpenSSH kimlik doğrulama öncesi yarış zafiyetinin (CVE-2024-6387) mimari açıklaması: SIGALRM işleme, glibc allocator reentrancy, Qualys laboratuvar sonuçları, upstream düzeltmenin davranışı ve işletim riskleri. https://ibrahimsql.tr/en/posts/regresshion-cve-2024-6387-anatomy-en https://ibrahimsql.tr/api/og?title=regreSSHion%20Anatomy%3A%20Deep%20Dive%20into%20OpenSSH%20Pre-Auth%20RCE%20(CVE-2024-6387) regreSSHion Anatomy: Deep Dive into OpenSSH Pre-Auth RCE (CVE-2024-6387) An architectural explanation of the OpenSSH pre-authentication race condition (CVE-2024-6387): SIGALRM handling, glibc allocator reentrancy, Qualys's lab results, the upstream fix behavior, and deployment caveats. https://ibrahimsql.tr/en/posts/rust-ve-go-ikilisi-en https://ibrahimsql.tr/api/og?title=Rust%20and%20Go%3A%20What%20the%20Two%20Together%20Actually%20Buy%20You Rust and Go: What the Two Together Actually Buy You Why I use Rust and Go together: the performance-and-safety axis, concurrency, deployment differences, and practical workload division. https://ibrahimsql.tr/tr/posts/rust-ve-go-ikilisi https://ibrahimsql.tr/api/og?title=Rust%20ve%20Go%3A%20%C4%B0kisi%20Birlikte%20Ne%20%C4%B0%C5%9Fe%20Yar%C4%B1yor Rust ve Go: İkisi Birlikte Ne İşe Yarıyor Rust ve Go'yu neden birlikte kullanıyorum: performans-ve-güvenlik ekseni, concurrency, dağıtım farkı ve pratik iş yükü paylaşımı. https://ibrahimsql.tr/en/posts/tr-burp-suite-lab-rehberi-en https://ibrahimsql.tr/api/og?title=Safe%20Lab%20Work%20with%20Burp%20Suite%3A%20A%20Starter%20Guide Safe Lab Work with Burp Suite: A Starter Guide A basic approach to setting up a legal, controlled, and repeatable laboratory while learning Burp Suite. https://ibrahimsql.tr/tr/posts/tr-burp-suite-lab-rehberi https://ibrahimsql.tr/api/og?title=Burp%20Suite%20ile%20G%C3%BCvenli%20Lab%20%C3%87al%C4%B1%C5%9Fmas%C4%B1%3A%20Ba%C5%9Flang%C4%B1%C3%A7%20Rehberi Burp Suite ile Güvenli Lab Çalışması: Başlangıç Rehberi Burp Suite öğrenirken yasal, kontrollü ve tekrar edilebilir bir laboratuvar düzeni kurmak için temel yaklaşım. https://ibrahimsql.tr/tr/posts/tr-guvenli-nextjs-uygulama-yapisi https://ibrahimsql.tr/api/og?title=G%C3%BCvenli%20Next.js%20Uygulama%20Yap%C4%B1s%C4%B1%3A%20K%C3%BC%C3%A7%C3%BCk%20Ekipler%20%C4%B0%C3%A7in%20Pratik%20Kontrol%20Listesi Güvenli Next.js Uygulama Yapısı: Küçük Ekipler İçin Pratik Kontrol Listesi Next.js projelerinde rota, environment değişkenleri, form güvenliği ve SEO temellerini aynı anda sağlamlaştırmak için uygulanabilir bir rehber. https://ibrahimsql.tr/tr/posts/tr-siber-guvenlik-risk-modeli https://ibrahimsql.tr/api/og?title=Siber%20G%C3%BCvenlikte%20Risk%20Modeli%3A%20%C3%96nce%20Neyi%20Korumal%C4%B1%3F Siber Güvenlikte Risk Modeli: Önce Neyi Korumalı? Siber güvenlik çalışmalarını rastgele araç denemelerinden çıkarıp ölçülebilir bir risk modeline bağlamak için pratik bir yaklaşım. https://ibrahimsql.tr/en/posts/tr-terminal-ag-araclari-cheatsheet-en https://ibrahimsql.tr/api/og?title=Terminal%20and%20Network%20Tools%20Cheatsheet%3A%20A%20Daily%20Security%20Workflow Terminal and Network Tools Cheatsheet: A Daily Security Workflow The core tool categories used in daily security work for the terminal, network observation, and documentation. https://ibrahimsql.tr/tr/posts/tr-terminal-ag-araclari-cheatsheet https://ibrahimsql.tr/api/og?title=Terminal%20ve%20A%C4%9F%20Ara%C3%A7lar%C4%B1%20Cheatsheet%3A%20G%C3%BCnl%C3%BCk%20G%C3%BCvenlik%20%C4%B0%C5%9F%20Ak%C4%B1%C5%9F%C4%B1 Terminal ve Ağ Araçları Cheatsheet: Günlük Güvenlik İş Akışı Günlük güvenlik çalışmalarında terminal, ağ gözlemi ve dokümantasyon için kullanılan temel araç kategorileri. https://ibrahimsql.tr/en/posts/wayland-compositor-en https://ibrahimsql.tr/api/og?title=Wayland%20Compositor%20Security%20Architecture%20and%20Privileged%20Client%20Management Wayland Compositor Security Architecture and Privileged Client Management A technical review of Wayland display-server security, compositor-mediated screen/input capabilities, remote-desktop portals, session locking, and sandbox metadata—grounded in protocol specifications and their implementation limits. https://ibrahimsql.tr/tr/posts/wayland-compositor-tr https://ibrahimsql.tr/api/og?title=Wayland%20Kompozit%C3%B6r%20G%C3%BCvenlik%20Mimarisi%20ve%20Ayr%C4%B1cal%C4%B1kl%C4%B1%20%C4%B0stemci%20Y%C3%B6netimi Wayland Kompozitör Güvenlik Mimarisi ve Ayrıcalıklı İstemci Yönetimi Teknik inceleme: Wayland görüntü sunucusu güvenliği, kompozitörün yönettiği ekran/girdi yetkileri, uzaktan masaüstü portalları, oturum kilitleme ve sandbox metadata'sı; protokol güvenceleri ile uygulama sınırları. https://ibrahimsql.tr/en/posts/zero-day-exploit-development-tutorial https://ibrahimsql.tr/api/og?title=Modern%20Linux%20Binary%20Exploitation%3A%20Memory%20Layout%2C%20Compiler%20Mitigations%2C%20and%20Gadget%20Mechanics Modern Linux Binary Exploitation: Memory Layout, Compiler Mitigations, and Gadget Mechanics An in-depth technical manual on x86_64 ELF memory corruption mechanics, compiler mitigations (Canaries, Full RELRO, PIE, Intel CET), sanitizer triage, and defensive binary engineering. https://ibrahimsql.tr/en/posts/en-bola-test-matrix-automation https://ibrahimsql.tr/api/og?title=Turning%20the%20BOLA%20Test%20Matrix%20into%20Automation%3A%20Keeping%20Authorization%20as%20Endpoints%20Grow Turning the BOLA Test Matrix into Automation: Keeping Authorization as Endpoints Grow Encoding the IDOR test matrix as code: a fixed set of role and tenant combinations that every new endpoint must pass before merging. https://ibrahimsql.tr/en/posts/en-burp-intruder-access-matrix https://ibrahimsql.tr/api/og?title=Scanning%20the%20Access%20Matrix%20with%20Burp%20Intruder%3A%20A%20Repeatable%20Setup Scanning the Access Matrix with Burp Intruder: A Repeatable Setup Scanning the authorization matrix with two sessions and an ID list: recording a baseline, bulk requests with the attacker cookie, triage by length, single-request confirmation. https://ibrahimsql.tr/en/posts/en-denied-request-alert-triage https://ibrahimsql.tr/api/og?title=Turning%20Denied%20Requests%20into%20Alerts%3A%20From%20Log%20to%20Triage Turning Denied Requests into Alerts: From Log to Triage Deny logs become attack signal: alert record format, scanning patterns, threshold tuning, and a response card confirmed with a single request. https://ibrahimsql.tr/en/posts/en-nextjs-server-actions-authorization https://ibrahimsql.tr/api/og?title=Authorization%20in%20Server%20Actions%3A%20Hiding%20the%20Button%20Is%20Not%20Protection Authorization in Server Actions: Hiding the Button Is Not Protection Next.js Server Actions are directly callable endpoints. A small policy pattern that moves the authorization check inside the action, plus how to test it. https://ibrahimsql.tr/en/posts/en-security-finding-scoring https://ibrahimsql.tr/api/og?title=Scoring%20Security%20Findings%3A%20An%20Impact-by-Reachability%20Table Scoring Security Findings: An Impact-by-Reachability Table CVSS alone lacks context: a practical prioritization table crossing data class and tenant breach with ease of access. https://ibrahimsql.tr/en/posts/en-security-logging-design https://ibrahimsql.tr/api/og?title=Security%20Logging%3A%20Who%20Accessed%20What%2C%20Decided%20How Security Logging: Who Accessed What, Decided How Authorization decisions must be observable: an event schema recording actor, tenant, object, action, and policy decision, plus how to test it. https://ibrahimsql.tr/en/posts/en-shadow-api-asset-inventory https://ibrahimsql.tr/api/og?title=Shadow%20APIs%20and%20Asset%20Inventory%3A%20Mapping%20the%20Attack%20Surface Shadow APIs and Asset Inventory: Mapping the Attack Surface You cannot protect an endpoint you do not know: an inventory record format and coverage metric built from code, traffic, and DNS sources. https://ibrahimsql.tr/tr/posts/tr-bola-test-matrisi-otomasyon https://ibrahimsql.tr/api/og?title=BOLA%20Test%20Matrisini%20Otomasyona%20Ba%C4%9Flamak%3A%20Endpoint%20B%C3%BCy%C3%BCrken%20Yetki%20Nas%C4%B1l%20Korunur BOLA Test Matrisini Otomasyona Bağlamak: Endpoint Büyürken Yetki Nasıl Korunur IDOR test matrisini kod haline getirmek: rol ve tenant kombinasyonlarını otomatik test eden, yeni endpoint eklenirken çalışması zorunlu bir düzen. https://ibrahimsql.tr/tr/posts/tr-burp-intruder-yetki-taramasi https://ibrahimsql.tr/api/og?title=Burp%20Intruder%20ile%20Yetki%20Matrisi%20Taramas%C4%B1%3A%20Tekrar%20Edilebilir%20Bir%20D%C3%BCzen Burp Intruder ile Yetki Matrisi Taraması: Tekrar Edilebilir Bir Düzen İki oturum ve bir ID listesiyle yetki matrisini taramak: baseline kaydı, saldırgan çereziyle toplu istek, uzunluk farkıyla ayıklama ve tek istekle doğrulama. https://ibrahimsql.tr/tr/posts/tr-golge-api-varlik-envanteri https://ibrahimsql.tr/api/og?title=G%C3%B6lge%20API%20ve%20Varl%C4%B1k%20Envanteri%3A%20Sald%C4%B1r%C4%B1%20Y%C3%BCzeyini%20Haritalamak Gölge API ve Varlık Envanteri: Saldırı Yüzeyini Haritalamak Bilmediğin endpoint'i koruyamazsın: kod, trafik ve DNS kaynaklarından saldırı yüzeyini çıkaran envanter kayıt formatı ve kapsama metriği. https://ibrahimsql.tr/tr/posts/tr-guvenlik-bulgusu-skorlama https://ibrahimsql.tr/api/og?title=G%C3%BCvenlik%20Bulgular%C4%B1n%C4%B1%20Skorlamak%3A%20Etki%20ve%20Eri%C5%9Filebilirlik%20Tablosu Güvenlik Bulgularını Skorlamak: Etki ve Erişilebilirlik Tablosu CVSS tek başına bağlam vermez: veri sınıfı ve tenant aşımı ile erişim kolaylığını çaprazlayan pratik bir önceliklendirme tablosu. https://ibrahimsql.tr/tr/posts/tr-guvenlik-loglama-tasarimi https://ibrahimsql.tr/api/og?title=G%C3%BCvenlik%20Loglamas%C4%B1%3A%20Kim%2C%20Neye%2C%20Hangi%20Kararla%20Eri%C5%9Fti Güvenlik Loglaması: Kim, Neye, Hangi Kararla Erişti Yetki kararları gözlemlenebilir olmalı: aktör, tenant, obje, aksiyon ve policy kararını kaydeden olay şeması ve test yaklaşımı. https://ibrahimsql.tr/tr/posts/tr-nextjs-server-actions-yetkilendirme https://ibrahimsql.tr/api/og?title=Server%20Actions'ta%20Yetkilendirme%3A%20Butonu%20Gizlemek%20Koruma%20De%C4%9Fildir Server Actions'ta Yetkilendirme: Butonu Gizlemek Koruma Değildir Next.js Server Action'lar doğrudan çağrılabilen endpoint'lerdir. Yetki kontrolünü action'ın içine taşıyan küçük bir policy deseni ve test yaklaşımı. https://ibrahimsql.tr/tr/posts/tr-reddedilen-istek-alarm-triyaj https://ibrahimsql.tr/api/og?title=Reddedilen%20%C4%B0steklerden%20Alarm%20%C3%9Cretmek%3A%20Logdan%20Triyaja Reddedilen İsteklerden Alarm Üretmek: Logdan Triyaja Deny logları saldırı sinyaline dönüşür: alarm kaydı formatı, tarama desenleri, eşik ayarı ve tek istekle doğrulanan yanıt kartı. https://ibrahimsql.tr/en/posts/htb-support-writeup-en https://ibrahimsql.tr/api/og?title=Support%3A%20From%20a%20.NET%20Binary%20to%20the%20DC Support: From a .NET Binary to the DC Solution chain for the HackTheBox Support box: a hidden binary on SMB, XOR credentials via monodis, a password in the LDAP info field, and Administrator on the DC via RBCD. https://ibrahimsql.tr/tr/posts/htb-support-writeup https://ibrahimsql.tr/api/og?title=Support%3A%20.NET%20Binary'den%20DC'ye Support: .NET Binary'den DC'ye HackTheBox Support makinesinin çözüm zinciri: SMB'de gizli binary, monodis ile XOR kimlik bilgisi, LDAP info alanı şifresi ve RBCD ile DC'ye Administrator. https://ibrahimsql.tr/en/posts/htb-twomillion-writeup-en https://ibrahimsql.tr/api/og?title=TwoMillion%3A%20From%20the%20Invite%20Code%20to%20Root TwoMillion: From the Invite Code to Root Full HackTheBox TwoMillion chain: decoding the public invite flow, privilege escalation through an accepted is_admin field, command injection, credential reuse, and CVE-2023-0386. https://ibrahimsql.tr/tr/posts/htb-twomillion-writeup https://ibrahimsql.tr/api/og?title=TwoMillion%3A%20Davet%20Kodundan%20Root'a TwoMillion: Davet Kodundan Root'a HackTheBox TwoMillion zinciri: public invite akışını çözme, kabul edilen is_admin alanıyla yetki yükseltme, komut enjeksiyonu, parola tekrarı ve CVE-2023-0386. https://ibrahimsql.tr/en/posts/en-api-access-control-test-plan https://ibrahimsql.tr/api/og?title=Your%20API%20Has%20Roles.%20That%20Does%20Not%20Mean%20Access%20Control%20Works Your API Has Roles. That Does Not Mean Access Control Works A practical test plan for object-level authorization, tenant isolation, and API access control bugs that survive happy-path role checks. https://ibrahimsql.tr/en/posts/en-nextjs-private-pages-noindex-is-not-auth https://ibrahimsql.tr/api/og?title=Noindex%20Is%20Not%20Auth%3A%20Protecting%20Private%20Pages%20in%20Next.js Noindex Is Not Auth: Protecting Private Pages in Next.js How to separate link-only pages from truly private content in Next.js App Router using robots metadata, middleware, server actions, and HttpOnly cookies. https://ibrahimsql.tr/tr/posts/tr-api-yetkilendirme-hatalari https://ibrahimsql.tr/api/og?title=API%20Yetkilendirme%20Hatalar%C4%B1%3A%20IDOR'u%20UUID%20ile%20%C3%87%C3%B6zd%C3%BC%C4%9F%C3%BCn%C3%BC%20Sanma API Yetkilendirme Hataları: IDOR'u UUID ile Çözdüğünü Sanma API güvenliğinde en pahalı hata genelde authentication değil authorization tarafında çıkar. IDOR, tenant izolasyonu ve obje bazlı kontrol için pratik bir test planı. https://ibrahimsql.tr/tr/posts/tr-nextjs-middleware-ile-ozel-sayfa-koruma https://ibrahimsql.tr/api/og?title=Next.js%20Proxy%20ile%20%C3%96zel%20Sayfa%20Koruma%3A%20Noindex%20Yetmez%2C%20Server%20Taraf%C4%B1nda%20Kilitle Next.js Proxy ile Özel Sayfa Koruma: Noindex Yetmez, Server Tarafında Kilitle Linki bilenlerin görebileceği sayfalar ile gerçekten şifreli alanlar farklıdır. Next.js'te noindex yalnız indekslemeyi etkiler; Proxy veya Middleware erken kapı olabilir, içeriği sunucu tarafında doğrulamak gerekir. https://ibrahimsql.tr/en/posts/htb-silentium-writeup-en https://ibrahimsql.tr/api/og?title=HackTheBox%20Silentium%20Writeup HackTheBox Silentium Writeup HTB Silentium chain: Flowise password-reset token disclosure, CustomMCP code injection, credential reuse, and the Gogs PutContents symlink flaw. https://ibrahimsql.tr/tr/posts/htb-silentium-writeup https://ibrahimsql.tr/api/og?title=HackTheBox%20Silentium%20Writeup HackTheBox Silentium Writeup HTB Medium Silentium: Flowise password-reset token disclosure, CustomMCP code injection, SSH password reuse, and the Gogs PutContents symlink flaw.