Yusuf AlMahmeed

Exploiting XXE to Perform SSRF

Fri, 09 Oct 2026 18:09:00 +0300


Platform	PortSwigger Web Security Academy
Topic	XML external entity (XXE) injection
Lab	Exploiting XXE to perform SSRF attacks
Difficulty	Apprentice
Goal	Read the server’s IAM credentials from cloud metadata
Tools	Burp Suite (Proxy + Repeater)

The idea

In the file-retrieval lab the external entity pointed at a local file with file://. Point it at an http:// URL instead and the XML parser becomes an HTTP client that fetches whatever URL we give it. That is SSRF (server-side request forgery): making the server send requests to targets we choose, from its own trusted position on the network.

Exploiting XXE to Retrieve Files

Fri, 09 Oct 2026 17:43:00 +0300


Platform	PortSwigger Web Security Academy
Topic	XML external entity (XXE) injection
Lab	Exploiting XXE using external entities to retrieve files
Difficulty	Apprentice
Goal	Read `/etc/passwd` from the server
Tools	Burp Suite (Proxy + Repeater)

What is XXE?

XML external entity (XXE) injection happens when an application parses XML we control, and the parser (the library that reads the XML and turns it into data the app can use) is allowed to process external entities. An entity in XML is a named placeholder, declared in a DTD (Document Type Definition) and referenced in the document; an external entity takes its value from a URI the parser fetches. If we can declare our own entity that points at a local file, the parser reads that file and we can often get the contents reflected back.

Shakabrah

Tue, 06 Oct 2026 00:00:00 +0000


Machine	Shakabrah
Platform	OffSec Proving Grounds
Difficulty	Easy
OS	Linux (Ubuntu)
Learning Path	Web fundamentals / OSWA & OSCP prep
Key Techniques	OS command injection, reverse shell, SUID binary privesc
Est. Time to Complete	~20–30 min

Overview

Shakabrah is a Linux box that comes down to two clean steps. The web server hosts a “Connection Tester” that pings whatever host you give it, and it builds that ping command by pasting your input straight onto a shell, so a shell metacharacter (a character the shell treats specially, like && or ;) turns the box into a command runner. That gets a reverse shell as www-data. From there, a single misconfigured SUID binary, vim.basic, is all it takes to become root. It shows how one unsanitized input and one over-privileged binary are enough to take a host from an open port to root.

Server-Side Template Injection in a Sandboxed Environment

Mon, 05 Oct 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	SSTI in a sandboxed environment
Difficulty	Expert
Engine	FreeMarker (Java), sandboxed
Goal	Read `/home/carlos/my_password.txt` and submit it
Tools	Browser, the Java API docs, a bytes-to-ASCII converter

The idea

In the documentation lab we escaped FreeMarker with ?new to instantiate Execute and run commands. Here that door is shut: the engine is sandboxed, so ?new and the dangerous helper classes are blocked. No arbitrary code execution.

Server-Side Template Injection via User-Supplied Objects

Mon, 05 Oct 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	SSTI with information disclosure via user-supplied objects
Difficulty	Practitioner
Engine	Django (Python)
Goal	Leak the framework’s `SECRET_KEY`
Tools	Browser, the engine’s own documentation

The idea

Not every SSTI ends in remote code execution. Django’s template language is deliberately sandboxed, there’s no {{7*7}} arithmetic, no imports, no os.system. But a sandbox that blocks code doesn’t necessarily block data: if a sensitive object is reachable from the template context, you can still read it. This lab leaks Django’s SECRET_KEY by doing exactly that.

Server-Side Template Injection with a Custom Exploit

Mon, 05 Oct 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	SSTI with a custom exploit
Difficulty	Expert
Engine	Twig (PHP)
Goal	Delete `/home/carlos/.ssh/id_rsa`
Tools	Browser, Burp Repeater, a text editor

The idea

Not every SSTI ends in a copy-paste payload for a known engine. This one is a custom exploit: we fingerprint the engine from its errors, notice that a real application object (user) is exposed inside the template, read the application’s own source code to learn what methods that object offers, and then chain two of those methods into exactly the primitive we need. No public payload exists for this; we build it from the app’s own code.

Basic Server-Side Template Injection (Code Context)

Tue, 29 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	Basic server-side template injection (code context)
Difficulty	Practitioner
Engine	Tornado (Python)
Goal	Delete `morale.txt` from Carlos’s home directory
Tools	Burp Suite (Proxy + Repeater)

Plaintext context vs code context

In the basic case , our input became the whole template, so we could inject template syntax directly. Here it’s different: our input is dropped into an existing template expression, something like {{ our_input }}. That’s a code context. To inject, we first have to break out of the current expression with }}, then add our own.

Cataract: Tiered Web Enumeration

Tue, 29 Sep 2026 00:00:00 +0000

Repo: github.com/YusufAlMahmeed/cataract . Star it and keep an eye on the GitHub page for updates. Bug reports, feature ideas, and suggestions are welcome: open an issue on the repo.

Cataract is actively maintained, so this page describes how it works rather than any one release. For the current flags, defaults, and release history, the repository and its changelog are always the source of truth.

What it is

Cataract is a small Bash tool for authorized web penetration testing. Its one-liner:

Server-Side Template Injection in an Unknown Language

Tue, 29 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	SSTI in an unknown language with a documented exploit
Difficulty	Practitioner
Engine	Handlebars (Node.js)
Goal	Delete `morale.txt` from Carlos’s home directory
Tools	Burp Suite (Repeater + Decoder)

The idea

You won’t always recognize the template syntax in front of you. That’s fine: the job is to make the server throw an error, read the stack trace to learn the engine, and then find a documented exploit for that engine. No prior knowledge of the language is required.

Server-Side Template Injection Using Documentation

Tue, 29 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	Server-side template injection using documentation
Difficulty	Practitioner
Engine	FreeMarker (Java)
Goal	Delete `morale.txt` from Carlos’s home directory
Tools	Browser, the engine’s own documentation

The idea

Sometimes you don’t need a memorised payload. Once you know which template engine is running, its official documentation will often hand you everything you need, including the features that turn template rendering into command execution. This lab is exactly that: identify the engine from an error message, then read the docs to build the exploit.

Basic Server-Side Template Injection

Mon, 28 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	Basic server-side template injection
Difficulty	Apprentice
Engine	ERB (Ruby)
Goal	Delete `morale.txt` from Carlos’s home directory
Tools	Burp Suite (Proxy + Repeater)

What is server-side template injection?

Server-side template injection (SSTI) happens when user input is embedded into a server-side template and then evaluated as template code rather than plain data. Because templates can run expressions (and often reach the underlying language), a successful injection usually leads to information disclosure or full remote code execution.

Blind OS Command Injection with Output Redirection

Sun, 27 Sep 2026 14:30:00 +0300


Platform	PortSwigger Web Security Academy
Topic	OS command injection
Lab	Blind OS command injection with output redirection
Difficulty	Practitioner
Goal	Run `whoami` and read its output
Tools	Burp Suite (Proxy + Repeater)

The idea

This is another blind injection: the feedback function runs a shell command with our input but returns nothing useful. Last time we proved execution with a time delay . This time we actually want the output of whoami, so we redirect it into a file inside a directory the web server will happily serve back to us, then just request that file.

Blind OS Command Injection with Time Delays

Sun, 27 Sep 2026 14:00:00 +0300


Platform	PortSwigger Web Security Academy
Topic	OS command injection
Lab	Blind OS command injection with time delays
Difficulty	Practitioner
Goal	Cause a 10-second delay to prove command execution
Tools	Burp Suite (Proxy + Repeater)

In the simple case the command’s output came straight back in the response. Here it doesn’t: the application runs a shell command with your input but never returns the result. That means we can’t just read the output of whoami, so we need an inference technique to confirm the injection actually ran.

OS Command Injection: Simple Case

Sat, 26 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	OS command injection
Lab	OS command injection, simple case
Difficulty	Apprentice
Goal	Execute `whoami` to retrieve the current user
Tools	Burp Suite (Proxy + Repeater)

What is OS command injection?

OS command injection (also called shell injection) happens when a web application passes user-controlled input into a system shell command without sanitizing it. If an attacker can inject shell metacharacters, they can append their own commands and have the server execute them, often with the privileges of the web application.

Potato

Fri, 25 Sep 2026 00:00:00 +0000


Machine	Potato
Platform	OffSec Proving Grounds (Practice)
Difficulty	Easy
OS	Linux
Learning Path	Web fundamentals / OSCP prep
Key Techniques	PHP type juggling, LFI, hash cracking, sudo wildcard privesc
Est. Time to Complete	~30–45 min

Overview

Potato is an easy-rated Linux box on OffSec Proving Grounds Practice. Despite the low difficulty, it strings together several instructive techniques: an exposed source-code backup leaks the login logic, a PHP type-juggling flaw bypasses authentication, the admin panel’s Logs page is vulnerable to Local File Inclusion, and a careless sudo wildcard rule provides the final step to root. It is a compact box where careful enumeration, not brute force, opens each step.

awards.md

Mon, 01 Jan 0001 00:00:00 +0000

cat awards.md

ISACA CDPSE Top Scorer

Recognized as the global Top Scorer for the Certified Data Privacy Solutions Engineer (CDPSE) examination by ISACA.

A certification that bridges technical security work and legal privacy requirements.
Covered privacy governance, data life-cycle management, and privacy-enhancing technologies.
Reflects how I approach privacy: built into systems from the design stage, not bolted on afterwards.

Al Baraka Islamic Bank Recognition

Formally recognized for exceptional performance as Information Security Section Head and Data Protection Guardian, and as a key driver of the bank’s strategic goals.

contact.md

Mon, 01 Jan 0001 00:00:00 +0000

cat contact.md

Feel free to reach out directly. I’m happy to talk cybersecurity, governance, data protection, or collaborating on relevant projects.

Email: yusuf.almahmeed@outlook.com
LinkedIn: linkedin.com/in/yusuf-almahmeed
GitHub: github.com/YusufAlMahmeed

gpg –show-keys yusuf-almahmeed.asc

For sensitive messages, encrypt to my PGP key.

Fingerprint: 1AA9 0ABC 0328 CF1A 3DDF 2C3C 0048 D251 1D85 421B

⤓ Download public key (.asc)

education.md

Mon, 01 Jan 0001 00:00:00 +0000

cat education.md

University Degrees

M.Sc. in Cybersecurity, University of Bahrain

2021 – 2023 · First-Class Honours

A Master’s in Cybersecurity at the University of Bahrain, taken to put a stronger theoretical foundation under existing hands-on experience. Graduated with First-Class Honours, alongside two published academic papers. The thesis, “Zero-day Attacks Detection Using a Threat Hunting Intelligence Approach”, looked at catching zero-day attacks earlier by improving detection with threat-hunting techniques.

B.Sc. Information & Communication Technology, Bahrain Polytechnic

2015 – 2020

experience.md

Mon, 01 Jan 0001 00:00:00 +0000

cat experience.md

A timeline of roles across banking security, governance, data protection, consulting and teaching.

Full-Time

Founder, RogSec Technology Solutions

2025 – present

Why launch RogSec? After more than five years in the banking industry, holding roles spanning end-to-end security from infrastructure to governance (infrastructure security, business continuity, disaster recovery, data privacy, information security), I founded RogSec to serve a broader range of clients and gain experience across different sectors and projects.

labs

Mon, 01 Jan 0001 00:00:00 +0000

ls -R labs/

Hands-on lab writeups, grouped by series. Each series is a set of related labs worked through in order.

PortSwigger: OS Command Injection

PortSwigger: Server-Side Template Injection

PortSwigger: XML External Entity Injection

machines

Mon, 01 Jan 0001 00:00:00 +0000

ls -R machines/

Machine and box walkthroughs, grouped by platform.

OffSec Proving Grounds

privacy.md

Mon, 01 Jan 0001 00:00:00 +0000

cat privacy.md

Last updated: 2026-09-28

What this site collects.

In your browser

The site stores a few functional preferences on your device, through your browser’s local and session storage:

Key	Purpose
`crt-disabled`	Your retro-CRT effects on/off choice
`crt-booted`	Whether the boot animation has played this session
`privacy-notice`	Whether you dismissed this notice this session

Server logs

The site is hosted on Cloudflare, which records standard server logs, including your IP address and basic request metadata (such as the requested URL, timestamp, and user agent), to deliver and secure the site. See the Cloudflare Privacy Policy .

publications.md

Mon, 01 Jan 0001 00:00:00 +0000

cat publications.md

Zero-day Attack Solutions Using Threat Hunting Intelligence: Extensive Survey

As technology advances, the attack surface grows and new threats become harder to mitigate, with zero-day attacks chief among them. Threat hunting is one technique used to detect them. This paper presents an extensive survey of the main approaches, challenges, and benefits of threat-hunting intelligence, and reviews state-of-the-art solutions for mitigating zero-day attacks, including SIEM tools, machine-learning solutions, and honeypot-based approaches.

tools

Mon, 01 Jan 0001 00:00:00 +0000

ls -la tools/

Tools I’ve built for security work, mostly small, focused command-line utilities. Each entry links to a writeup here and to the source on GitHub .

Cataract: Tiered Web Enumeration — Cataract is a Bash tool that cascades escalating wordlist tiers through feroxbuster while running nmap in the background, for authorized web enumeration.

Yusuf AlMahmeed

Exploiting XXE to Perform SSRF

The idea

Exploiting XXE to Retrieve Files

What is XXE?

Shakabrah

Overview

Server-Side Template Injection in a Sandboxed Environment

The idea

Server-Side Template Injection via User-Supplied Objects

The idea

Server-Side Template Injection with a Custom Exploit

The idea

Basic Server-Side Template Injection (Code Context)

Plaintext context vs code context

Cataract: Tiered Web Enumeration

What it is

Server-Side Template Injection in an Unknown Language

The idea

Server-Side Template Injection Using Documentation

The idea

Basic Server-Side Template Injection

What is server-side template injection?

Blind OS Command Injection with Output Redirection

The idea

Blind OS Command Injection with Time Delays

What makes this one “blind”?

OS Command Injection: Simple Case

What is OS command injection?

Potato

Overview

awards.md

ISACA CDPSE Top Scorer

Al Baraka Islamic Bank Recognition

contact.md

education.md

University Degrees

M.Sc. in Cybersecurity, University of Bahrain

B.Sc. Information & Communication Technology, Bahrain Polytechnic

experience.md

Full-Time

Founder, RogSec Technology Solutions

labs

PortSwigger: OS Command Injection

PortSwigger: Server-Side Template Injection

PortSwigger: XML External Entity Injection

machines

OffSec Proving Grounds

privacy.md

In your browser

Server logs

publications.md

Zero-day Attack Solutions Using Threat Hunting Intelligence: Extensive Survey

tools