Md Noor Fairouz Bin Md Asman

Where your proof lands

Derived from what each verified ledger entry actually covers.

• Web & AppSec78
  Evidence

  The search route parameterises q but concatenates sort directly into `ORDER BY ${sort}`. A

  A PDF preview endpoint accepts a URL. Supplying http://169.254.169.254/latest/meta-data/ c

  During an authorised pentest, GET /api/invoices/184 returns your invoice. Changing 184 to

  DrNotSoStrange
• Networks & protocols78
  Evidence

  First night on a hospital SOC: a scan shows TCP 443 open on the patient portal. Which serv

  A compromised test host in the user VLAN can open outbound TCP connections to arbitrary in

  Two hosts suddenly report the gateway IP at a new MAC address; packet capture shows repeat

  A Windows file share is reachable on TCP 445. Which protocol are you looking at?

  DrNotSoStrange
• Forensics & DFIR35
  Evidence

  The same cloud session token is used from Buenos Aires and Warsaw six minutes apart, with

  EDR records powershell.exe -NoP -W Hidden -EncodedCommand followed by a connection to a ne

  A suspicious email includes an attachment. What is a safe first step?
• Cryptography31
  Evidence

  An encrypted image still reveals repeated visual blocks. Which AES mode is famous for this

  A startup pastes a Base64 customer token into a public support ticket because it 'looks en

  An API validates webhook HMACs with a loop that returns immediately at the first mismatchi

  Encrypted profile cookies contain repeated 16-byte ciphertext blocks whenever repeated rol
• Cloud & containers27
  Evidence

  A CI role used to deploy one Lambda has `iam:PassRole` on `*` and permission to update arb

  A URL previewer inside a cloud VM is being abused to hunt for temporary credentials. Which

  A storage bucket denies listing but permits anonymous PutObject to the prefix used by the
• Active Directory24
  Evidence

  A normal user can add themselves to Domain Admins. What kind of problem is this?

  A typo in a network path makes Windows ask the local network for the name and an attacker

  SMB signing is optional on several servers and LDAP signing/channel binding is not enforce

  A low-privilege domain account requests a service ticket for svc_sql; the SPN account uses
• Recon & OSINT24
  Evidence

  A scoped staging host returns 200 for /.git/HEAD and exposes refs, while directory listing

  A mobile app references assets-prod-company.s3.amazonaws.com; anonymous listing is denied

  A web root exposes /.git/. What could an attacker recover?

  You discover a company subdomain during a bounty. Can you test it immediately?
• Code & tooling23
  Evidence

  The build requests `company-auth` without a registry scope; the name is absent publicly an

  A Node route executes `exec('ping -c 1 ' + req.body.host)` after checking only that host i

Everything below is priced. Pick the cheapest one and the gap closes.

1. Connect Hack The Box

   Rank, owns and global standing pulled from your profile.

   +300

   points
   52% of the gap
2. Claim a CVE

   Any published advisory with your name on the credit line.

   +260

   points
   45% of the gap
3. Connect GitHub

   Public tooling, exploits and the code you shipped.

   +160

   points
   28% of the gap
4. Clear another lab

   28 lab entries scored. 1,774 points left before the lab ceiling.

   +60

   points
   10% of the gap
5. Publish a write-up

   Explain the bug, impact and fix. Peer-reviewed write-ups score after approval.

   +180

   points
   31% of the gap
6. Submit a vulnerability report

   A confirmed low, medium, high or critical report is the cleanest path up the ladder.

   +160

   points
   28% of the gap