https://blog.abartan.net/posts/ Recent content in Posts on haxormad Hugo en Mon, 12 Oct 2026 11:00:00 +1000 https://blog.abartan.net/posts/how-a-custom-honeypot-caught-a-live-docker-cryptojacking-campaign/ Mon, 12 Oct 2026 11:00:00 +1000 https://blog.abartan.net/posts/how-a-custom-honeypot-caught-a-live-docker-cryptojacking-campaign/ A custom Linux honeypot caught a multi-stage cryptojacking campaign targeting exposed Docker APIs on July 17, 2026. The payload deployed XMRig via container escape, and its indicators overlap with the Diicot threat cluster. https://blog.abartan.net/posts/hello-world/ Mon, 12 Oct 2026 00:00:00 +0000 https://blog.abartan.net/posts/hello-world/ Setting up the blog. Security research, offensive security notes, and build logs incoming. https://blog.abartan.net/posts/spyse-cybersecurity-search-engine/ Sun, 30 Aug 2020 00:00:00 +1000 https://blog.abartan.net/posts/spyse-cybersecurity-search-engine/ A comparison of Spyse and Shodan for bug bounty recon, covering subdomain enumeration, certificate pivoting, port scanning, and API differences. https://blog.abartan.net/posts/ship-it-to-me-for-free/ Sun, 08 Sep 2019 00:00:00 +1000 https://blog.abartan.net/posts/ship-it-to-me-for-free/ How I found a price manipulation vulnerability in an e-commerce checkout flow that let me get express shipping for free, earning my first four-figure bug bounty. https://blog.abartan.net/posts/chromecast-leaks-app-data/ Sun, 26 May 2019 00:00:00 +1000 https://blog.abartan.net/posts/chromecast-leaks-app-data/ How I discovered that Chromecast devices leak the name of the app being streamed to anyone on the same network via mDNS. https://blog.abartan.net/posts/tips-for-awesome-infosec-conferences/ Sun, 31 Mar 2019 00:00:00 +1000 https://blog.abartan.net/posts/tips-for-awesome-infosec-conferences/ First-timer tips for getting the most out of infosec conferences, from grabbing swag to making lasting connections. https://blog.abartan.net/posts/insecure-direct-object-reference-idor/ Sun, 27 Jan 2019 00:00:00 +1000 https://blog.abartan.net/posts/insecure-direct-object-reference-idor/ A beginner-friendly guide to finding, exploiting, and preventing IDOR vulnerabilities in web applications. https://blog.abartan.net/posts/my-journey-to-google-hall-of-fame/ Sun, 25 Nov 2018 00:00:00 +1000 https://blog.abartan.net/posts/my-journey-to-google-hall-of-fame/ How I chained an open redirect with XSS on a Google acquisition (Sidewalk Labs) to earn a spot in Google's Hall of Fame — after seven months of invalid reports. https://blog.abartan.net/posts/lets-talk-about-ciphers/ Sun, 04 Nov 2018 00:00:00 +1000 https://blog.abartan.net/posts/lets-talk-about-ciphers/ A beginner-friendly introduction to classical ciphers — how the Caesar cipher and Baconian cipher work, with examples for CTF challenges. https://blog.abartan.net/posts/so-you-wanna-be-a-hacker/ Sun, 26 Aug 2018 00:00:00 +1000 https://blog.abartan.net/posts/so-you-wanna-be-a-hacker/ A beginner's guide to getting started in hacking — what a hacker is, the mindset you need, and a step-by-step path from web development basics to OWASP Top 10 practice. https://blog.abartan.net/posts/my-first-swag-pack-logical-bug-edmodo/ Sun, 05 Aug 2018 00:00:00 +1000 https://blog.abartan.net/posts/my-first-swag-pack-logical-bug-edmodo/ How I found a simple logical flaw in Edmodo's phone verification that could block users from enabling two-factor authentication — and earned my first swag pack. https://blog.abartan.net/posts/tips-from-a-bugbounty-hunter/ Sun, 29 Jul 2018 00:00:00 +1000 https://blog.abartan.net/posts/tips-from-a-bugbounty-hunter/ Beginner bug bounty tips covering Google dorking, subdomain enumeration, and hunting for logical flaws — the methods that landed my first bounties.