Faridh Wajli

Where your proof lands

Derived from what each verified ledger entry actually covers. You have nothing in active directory, cryptography, forensics & dfir, cloud & containers.

• Web & AppSec231
  Evidence

  An API accepts a JWT whose header was changed from RS256 to HS256 and signed with the publ

  The search route parameterises q but concatenates sort directly into `ORDER BY ${sort}`. A

  A PDF preview endpoint accepts a URL. Supplying http://169.254.169.254/latest/meta-data/ c

  During an authorised pentest, GET /api/invoices/184 returns your invoice. Changing 184 to

  POST /account/email changes the logged-in user's email using only a session cookie; a cros

  A comment containing `<script>alert(1)</script>` runs for every visitor. What is the bug?

  An image-from-URL feature can fetch http://127.0.0.1/admin from the server. What is this?

  Deprecated Cryptographic Algorithms and Password Authentication Enabled on aarts.info

  You change /users/41 to /users/42 and see another user's profile. What is this?

  Adding a single quote to a product ID changes the response to a SQL syntax error. What sho
• Code & tooling106
  Evidence

  Mr-C0k1
• Networks & protocols101
  Evidence

  An internal admin service uses TLS, but its certificate is valid for old-admin.corp while

  A workstation sends hundreds of long, unique TXT queries under one domain every 30 seconds

  Two hosts suddenly report the gateway IP at a new MAC address; packet capture shows repeat

  The office can reach IP addresses but every hostname fails. Your packet capture shows unan

  A cashier terminal knows the gateway's IPv4 address but needs its local hardware address b

  A compromised test host in the user VLAN can open outbound TCP connections to arbitrary in

  A host can ping a server but cannot connect to its TCP 8080 service. What should you check

  A perimeter scan finds TCP 445 reachable from the internet on a file server that also acce

  First night on a hospital SOC: a scan shows TCP 443 open on the patient portal. Which serv
• Recon & OSINT12
  Evidence

  Certificate history and passive DNS reveal origin-old.example.com on an address in the com

  You want subdomains without sending traffic to the target. Which approach fits?
• Active Directoryno proof yet
• Cryptographyno proof yet
• Forensics & DFIRno proof yet
• Cloud & containersno proof yet

Everything below is priced. Pick the cheapest one and the gap closes.

1. Connect Hack The Box

   Rank, owns and global standing pulled from your profile.

   +300

   points
   67% of the gap
2. Claim a CVE

   Any published advisory with your name on the credit line.

   +260

   points
   58% of the gap
3. Connect TryHackMe

   Points and completed rooms.

   +180

   points
   40% of the gap
4. Clear another lab

   28 lab entries scored. 1,756 points left before the lab ceiling.

   +60

   points
   13% of the gap
5. Review another hacker's work

   Accepted peer review adds small points and proves you can judge other hackers' reasoning.

   +15

   points
   3% of the gap
6. Land another confirmed report

   1 confirmed report already. Reports have no ceiling; confirmed impact keeps moving the rank.

   +360

   points
   80% of the gap