https://melodickat.github.io/A personal blog by Nguyen Giap Anh Khoa, documenting explorations in cybersecurity, reverse engineering, low-level systems and occasional fiction writing. 2026-07-09T10:27:37+07:00 Nguyen Giap Anh Khoa https://melodickat.github.io/ Jekyll © 2026 Nguyen Giap Anh Khoa /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-07-07T14:34:49+07:00 2026-07-07T14:34:49+07:00 https://melodickat.github.io/posts/module-15-web-attacks-part2/ Nguyen Giap Anh Khoa

SECTION 14: Local File Disclosure Question 1 Try to read the content of the ‘connection.php’ file, and submit the value of the ‘api_key’ as the answer. UTM1NjM0MmRzJ2dmcTIzND0wMXJnZXdmc2RmCg Access the web page Identify the request send when submit information Identifying the vulnerability, inject new entity. Craft the payload Get the flag SECTION 15: Advanced File Disclosure <!DOCTYPE ...

2026-07-07T14:33:19+07:00 2026-07-07T14:33:19+07:00 https://melodickat.github.io/posts/module-20-bug-bounty-progress/ Nguyen Giap Anh Khoa

SECTION 1: Bug Bounty Programs Tổng Quan Bug Bounty Program (BBP) / Vulnerability Rewards Program (VRP): chương trình kiểm thử bảo mật liên tục, bổ sung cho code audit và pentest nội bộ. Khác với Vulnerability Disclosure Program (VDP): VDP chỉ cung cấp hướng dẫn báo cáo, không có phần thưởng tiền mặt. Phân Loại Loại Mô tả Private B...

2026-07-07T14:32:24+07:00 2026-07-07T14:32:24+07:00 https://melodickat.github.io/posts/module19-attacking-common-applications-skills-assessment/ Nguyen Giap Anh Khoa

Attacking Common Applications - Skills Assessment I During a penetration test against the company Inlanefreight, you have performed extensive enumeration and found the network to be quite locked down and well-hardened. You come across one host of particular interest that may be your ticket to an initial foothold. Enumerate the target host for potentially vulnerable applications, obtain a footho...

2026-07-07T14:31:00+07:00 2026-07-07T14:31:00+07:00 https://melodickat.github.io/posts/module19-attacking-common-application-part-3/ Nguyen Giap Anh Khoa

SECTION 21: Attacking Thick Client Applications Tổng Quan Thick client app: cài locally, không cần internet, xử lý tại client (khác thin client chạy trên server qua browser). Thường viết bằng: Java, C++, .NET, Microsoft Silverlight. Kiến trúc: Two-tier: app giao tiếp trực tiếp với database. Three-tier: app → application server (HTTP/HTTPS) → database (bảo mật hơn). ...

2026-07-07T14:30:00+07:00 2026-07-07T14:30:00+07:00 https://melodickat.github.io/posts/module19-attacking-common-application-part-2/ Nguyen Giap Anh Khoa

SECTION 11: Jenkins - Discovery & Enumeration Tổng Quan Jenkins: automation server viết bằng Java, chạy trong servlet container (như Tomcat); dùng cho continuous integration. Trước đây tên Hudson (2005), đổi tên năm 2011 sau tranh chấp với Oracle. 86,000+ công ty sử dụng (Facebook, Netflix, Udemy, Robinhood, LinkedIn). 300+ plugins hỗ trợ build/test. Nhiều vulnerability ch...