Cyber Security Writeups
CYBERSECWRITEUPS.COM · OFFENSIVE SECURITY BLOG

A Practical Guide to Modern Cyber Offense

Hands-on writeups, attack paths, exploitation notes and automation scripts across Web, Cloud, Active Directory, Mobile and AI/LLM security. All content is for authorized, ethical security testing only.

Real-world pentest & red team notes Web · Infra · Cloud · AD · AI Scripts, payloads & automation

Android & iOS Application Security Testing: Identifying App Types and Tailoring Your VAPT Strategy

February 18, 2026 · khukuririmal · Blog

Mobile application security testing is no longer limited to just “Android vs iOS.” Modern applications span native, hybrid, WebView-based, and cross-platform architectures, each introducing unique attack surfaces, tooling requirements, and testing techniques. During Mobile Application VAPT, the first critical step is identifying what kind of app you’re dealing with. This directly influences: Misidentifying an app […]

ART of Google Dorking – Turning Search Engines Into a Recon Weapon for Red Teaming & VAPT

February 5, 2026 · khukuririmal · Red Teaming

In modern security assessments, researchers and pentesters rarely start with direct exploits, they start with gathering information. One of the most underestimated reconnaissance tools is sitting in front of everyone which is the Google Search engine. When used strategically, Google Dorking becomes an attack surface mapper, unintentionally exposing sensitive assets, internal systems, misconfigurations, credentials, backups, […]

Practical Guide to Subdomain Enumeration for Red Teaming

January 19, 2026 · khukuririmal · Red Teaming

In reconnaissance, what you fail to enumerate is often what hurts the most. Subdomain enumeration is one of the most critical phases of reconnaissance in any Red Team Assessment. Missed subdomains often mean missed attack surfaces, such as forgotten admin panels, staging environments, internal APIs, or legacy services that were never meant to be exposed […]

Practical Guide for Thick Client Penetration Testing

January 15, 2026 · khukuririmal · Pentesting Fundamentals

Thick client applications remain a high risk yet often under-tested attack surface in enterprise environments. Unlike thin clients (browser-based apps), thick clients run directly on end-user systems, communicate with backend services over custom protocols, and often embed sensitive logic locally. We have covered in detail about thick client testing, methodology, attack surface etc in our […]

Thick Client Security Testing: Concepts, Attack Surface, Methodology & Vulnerabilities

January 14, 2026 · khukuririmal · Pentesting Fundamentals

Thick client applications continue to play a critical role in enterprise environments, especially within banking, finance, ERP systems, trading platforms, HR systems, OT environments, and internal administrative tools. Despite this, thick client security testing is often poorly understood or completely omitted from traditional VAPT engagements. Unlike web applications, thick clients execute significant logic locally and […]

Creating a Bootable Kali Linux USB for Professional Pentesting

January 10, 2026 · khukuririmal · Pentesting Fundamentals

Kali Linux is the industry-standard operating system for penetration testing, red teaming, and security research. While Kali can be installed on a laptop or run inside a virtual machine, a bootable Kali Linux USB remains one of the most practical and powerful approaches for real-world security assessments.For internal VAPT, red teaming, and onsite assessments, carrying […]