Curious security researcher and developer who loves breaking systems, solving CTF puzzles, and building open-source security tools.https://xomnibot.in/en-ushttps://xomnibot.in/writeups/tryhackme-pickle-rick/https://xomnibot.in/writeups/tryhackme-pickle-rick/A Rick and Morty themed CTF challenge requiring web reconnaissance, unauthenticated command injection exploitation, and sudo privilege escalation to retrieve all three secret ingredients.Wed, 05 Aug 2026 00:00:00 GMTwebcommand-injectionprivilege-escalationsudohttps://xomnibot.in/research/oauth-redirect-uri-bypass-case-study/https://xomnibot.in/research/oauth-redirect-uri-bypass-case-study/Reproducing a classic OAuth 2.0 redirect_uri validation flaw in a self-built lab: how loose prefix matching leaks authorization codes, and how to fix it.Tue, 04 Aug 2026 00:00:00 GMToauthauthenticationweb-securityaccount-takeoverhttps://xomnibot.in/projects/omniscanner/https://xomnibot.in/projects/omniscanner/High-performance asynchronous binary vulnerability triage tool written in Rust.Tue, 04 Aug 2026 00:00:00 GMTrustbinary-analysisvulnerability-scannerhttps://xomnibot.in/blog/2026-cybersecurity-roadmap/https://xomnibot.in/blog/2026-cybersecurity-roadmap/A practical, zero-fluff breakdown of how I structure daily security research, binary exploitation practice, and building open-source tools.Mon, 03 Aug 2026 00:00:00 GMTcareerctflearning-roadmaphttps://xomnibot.in/writeups/portswigger-oauth-account-takeover/https://xomnibot.in/writeups/portswigger-oauth-account-takeover/Exploiting unvalidated redirect URIs and implicit grant token leaks to achieve pre-auth account takeover.Sat, 01 Aug 2026 00:00:00 GMTOAuth 2.0JWTAccount Takeoverhttps://xomnibot.in/writeups/tryhackme-ad-enterprise-chain/https://xomnibot.in/writeups/tryhackme-ad-enterprise-chain/Full attack path from unauthenticated AS-REP roasting to BloodHound ACL traversal and DCSync domain compromise.Mon, 20 Jul 2026 00:00:00 GMTKerberosAS-REP RoastingBloodHoundDCSync