Breaking In Without a Key: Chaining Client-Side Auth Into Stored HTML Injection

Sat, 09 May 2026 14:00:00 +0200

$ ./intro

Some targets look locked down at first glance. Login page, redirect on every protected URL, role-gated sections marked “Not Authorized.” You open Burp, run a few requests, and think “this is going to be a long day.”

Then you notice that none of the HTTP responses ever return a 302. And your whole afternoon changes.

This is a writeup of a web application penetration test against an internal manufacturing dashboard — a platform used by engineers, factory leads, and regional teams to track production data, file technical issues, and manage order queues. The application had a multi-role access model with pages supposedly gated behind authorization checks. What it did not have was any of those checks running on the server.

Welcome to Dedsec

Sat, 09 May 2026 10:00:00 +0200

$ ./init

This blog will document offensive security engagements, techniques, and research.

Topics covered:

Web & API penetration testing
Active Directory exploitation
Red team operations
Mobile security
Exploit development

Stay tuned.

whoami

Sat, 09 May 2026 00:00:00 +0000

$ ./about

Senior Offensive Security Consultant based in Egypt, focused on adversarial simulation and offensive research.

This blog documents engagements, techniques, and research from real-world penetration testing — primarily web, API, Active Directory, and red team operations, with ongoing work in reverse engineering and exploit development.

$ ./focus

Web & API Security — application logic flaws, authentication and authorization bypasses, injection chains
Active Directory & Red Teaming — full kill chain operations, credential access, lateral movement, privilege escalation
Mobile Security — Android dynamic analysis, static analysis, runtime instrumentation
Reverse Engineering & Exploit Development — currently advancing through Ret2 Systems’ Software Exploitation curriculum

$ ./certifications

OSCP
Offensive Security Certified Professional

CRTO
Certified Red Team Operator

CRTP
Certified Red Team Professional

HTB CPTS
Hack The Box Certified Penetration Testing Specialist

CAPen
Certified AppSec Pentester · SecOps Group

CNPen
Certified Network Pentester · SecOps Group

eCPPTv2
eLearnSecurity Certified Professional Penetration Tester

PT1
TryHackMe Penetration Tester I

RastaLabs
Hack The Box ProLab

$ ./domains

Web Application Pentesting

OWASP Top 10
Business logic flaws
Authentication bypasses
Injection chains (SQLi, SSTI, SSRF)
Access control flaws

API Pentesting

REST and GraphQL testing
BOLA / IDOR exploitation
Mass assignment
JWT abuse
Rate limiting bypass

Active Directory & Red Teaming

Full kill chain operations
Kerberos attacks (Kerberoasting, ASREP)
NTDS.dit extraction
Lateral movement and pivoting
Cross-forest compromise

Network Pentesting

Internal infrastructure assessment
External perimeter testing
Service exploitation
SMB and LDAP abuse
Post-exploitation enumeration

Mobile Pentesting

Android dynamic analysis with Frida
Static analysis with Jadx and MobSF
Runtime instrumentation
IPC and intent abuse
Root detection bypass

Source Code Review

White-box web app assessment
API source review
Java, .NET, PHP, Node.js
Secure coding evaluation
SAST integration

Desktop Application Pentesting

Thick-client testing
.NET reverse engineering
Local privilege escalation
Insecure deserialization
IPC and DLL hijacking

Reverse Engineering

Binary analysis (Ghidra, IDA)
.NET decompilation (dnSpy)
Malware analysis basics
Protocol reverse engineering
Anti-debugging bypass

Exploit Development

Stack and heap overflows
ROP chain construction
Modern mitigation bypass
Ret2 Systems curriculum
Userland exploitation

Phishing & Social Engineering

Adversarial campaigns
Evilginx credential harvesting
Multi-stage payload delivery
Awareness assessments
Pretext development

Configuration Reviews

Firewall rule auditing
Router and switch hardening
Enterprise security solutions
CIS benchmarks
Network segmentation review

Vulnerability Assessment

Tenable Nessus scans
Nmap and service enumeration
Manual validation
Risk prioritization
Remediation guidance

$ ./experience

Senior Offensive Security Consultant — CyberTeq · Jun 2025 – Present
Offensive Security Engineer — EFG Holding · Jan 2024 – May 2025
Cyber Security Researcher — Resecurity · 2023
Penetration Tester — DOMINFOSEC SOLUTIONS LLP · 2023

$ ./contact

GitHub: DEDSEC-2
LinkedIn: Momen Mahmoud
Email: momenmahmoud478 [at] gmail [dot] com

Currently exploring exploit development and offensive AI research. Open to collaboration on offensive security writeups and tooling.