https://hustlerx.si/blog/Technical noteshttps://hustlerx.si/blog/cloudsek-ctf-2025-writeuphttps://hustlerx.si/blog/cloudsek-ctf-2025-writeupHow I chained five flags in the CloudSEK Hiring CTF: email OSINT to a leaked Git secret, prompt injection and Morse audio, an alg:none JWT forge, an IDOR plus MFA-backup-code bypass, and finally SSRF into EC2 metadata for S3 credentials.https://hustlerx.si/blog/evtx-triage-real-sampleshttps://hustlerx.si/blog/evtx-triage-real-samplesUnit tests passed, then real Windows logs broke four rules. Zero-padded hex, missing parent fields and registry paths I didn't expect.https://hustlerx.si/blog/phishing-eml-spf-dkim-dmarchttps://hustlerx.si/blog/phishing-eml-spf-dkim-dmarcBuilding an .eml analyser for Indian bank and UPI lures, and what its 9 errors on 69 lab emails taught me.https://hustlerx.si/blog/owasp-mapped-url-shortenerhttps://hustlerx.si/blog/owasp-mapped-url-shortenerAbout 250 lines of FastAPI, each control mapped to an OWASP Top 10 category and a named pytest, then attacked live.https://hustlerx.si/blog/api-tests-that-fail-on-bad-buildshttps://hustlerx.si/blog/api-tests-that-fail-on-bad-buildsSeeding 6 OWASP API defects into a test API to check that the suite catches them, plus 3 bugs schemathesis found on its own.