OFFENSIVE RESEARCH & EXPLOITATION DOCUMENTATION

Security Research & Writeups

Technical post-mortems, CTF box walk-throughs, Active Directory attack paths, mobile runtime instrumentation, and vulnerability findings authored by Omar Adel Mahmoud.

4 writeups published

HackTheBox

MEDIUM

Oct 2026 • 12 min read

6 0

Forest (HackTheBox): Active Directory Kerberoasting & BloodHound Privilege Escalation

Comprehensive intrusion walkthrough against a Windows Active Directory domain controller. Covers roasting pre-authentication disabled accounts (AS-REP Roasting), BloodHound shortest path ingestion, and Domain Admin takeover via WriteDacl abuse on Exchange Windows Permissions.

#Active Directory #BloodHound #Kerberos

Read Technical Breakdown → Verified PoC

Internal Pivoting & Lateral Movement: Chaining Chisel, Proxychains & WMI Exec

Offensive Operations

MEDIUM

Oct 2026 • 9 min read

6 0

Internal Pivoting & Lateral Movement: Chaining Chisel, Proxychains & WMI Exec

Field operations methodology for pivoting through deeply segmented enterprise perimeters. Establishing encrypted SOCKS5 tunnels over HTTP/WebSocket and orchestrating multi-hop lateral movement.

#Network Pivoting #Chisel #Proxychains

Read Technical Breakdown → Verified PoC

Dynamic Instrumentation & SSL Pinning Bypass on Android FinTech App via Frida

Mobile Pentest / Research

HARD

Oct 2026 • 15 min read

6 0

Dynamic Instrumentation & SSL Pinning Bypass on Android FinTech App via Frida

Deep-dive security assessment of an obfuscated Android banking application. Demonstrates multi-layered SSL Pinning circumvention across OkHttp3 and TrustManager using customized Frida JavaScript hooks and runtime memory inspection.

#Android #Frida #ADB

Read Technical Breakdown → Verified PoC

GraphQL Authorization Bypass to Full Account Takeover (Bug Bounty Finding)

Real-World Bug Bounty

EASY

Oct 2026 • 7 min read

3 0

GraphQL Authorization Bypass to Full Account Takeover (Bug Bounty Finding)

Real-world vulnerability case study detailing an insecure direct object reference (IDOR) and mass assignment vulnerability in a GraphQL mutation leading to account takeover.

#GraphQL #IDOR #Web Pentest

Read Technical Breakdown → Verified PoC