Aspiring Application Security / Penetration Tester — documenting every lab I solve, end to end.
I work across web application security and mobile pentesting (Android & iOS): solving hands-on labs, building small exploit tools and solver scripts, and publishing step-by-step write-ups so anyone can reproduce the work.
| Repo | What's inside |
|---|---|
| portswigger-labs-writeups | 273 labs across 31 topics of the PortSwigger Web Security Academy — full step-by-step solutions: SQLi, XSS, SSRF, JWT, GraphQL, request smuggling, prototype pollution, ... |
| androgear | gear CLI — Android pentesting toolkit for lab AND production APKs: one-command triage (framework/packer/tracker detection, obfuscation, signature schemes), deep-link & exported-component enumeration with ready adb triggers, secret hunting, a 12-hook Frida arsenal, pentest-report scaffolding |
| cylab-academy-writeups | 100 writeups for the CyLab Security Academy library (formerly picoCTF) — Web Exploitation, Reverse Engineering, Forensics, Crypto and Pwn, each closing with a report-ready impact/remediation paragraph |
| android-pentesting-cheatsheet | Android pentesting from zero to hero — 16 cheatsheets + scripts: lab setup, ADB, Frida/Objection, Burp MITM, IPC & deep links, native bypasses, MASVS checklist, automated MobSF triage pipeline |
| ios-pentesting-cheatsheet | The iOS counterpart — 10 cheatsheets + a 7-script Frida pack + host tools: jailbreaks, IPA analysis, ObjC hooks, Keychain, pinning bypass, MASVS checklist |
| 8ksec-labs-writeups | 8kSec Academy & Battlegrounds Android & iOS exploitation labs — 21 writeups (10 Android, 11 iOS) with PoC exploit apps and automated solver scripts |
| I'm interested in... | Start here |
|---|---|
| Web security (topic by topic) | portswigger-labs-writeups — pick a topic folder (sql-injection, ssrf, jwt, ...) |
| CTF challenges (picoCTF / CyLab) | cylab-academy-writeups — indexed by category, difficulty, and a suggested learning order |
| Android pentesting, first steps | android-pentesting-cheatsheet README (roadmap + 60-second workflow) — or let androgear triage map an APK for you |
| Frida & dynamic analysis | android file 06 · ios scripts/ |
| iOS pentesting | ios-pentesting-cheatsheet cheatsheet/ |
| Mobile Hacking Lab write-ups | android writeups/ · ios writeups/ |
- Working through the Mobile Hacking Lab track (51 labs, Android + iOS) — 23 write-ups so far
- Solving the CyLab Security Academy (picoCTF) challenge library and writing up every solve
- Growing a reusable Frida bypass/script arsenal for hardened apps
- Turning the MASVS checklist into repeatable per-app test runs
- All write-ups are for educational purposes only, on intentionally vulnerable lab environments and systems I am authorized to test.
- Everything is reproducible with free tooling — no paid licenses required.
MIT licensed unless a repo says otherwise.