The personal
security lab
of nybik
Pentest, CTF and Linux hardening. Documented, reproducible and written up for whoever comes next.
Built for breaking
things
Four areas, one mindset. Understand how it breaks, then make sure it doesn't.
Web pentest
Recon, OWASP Top 10, auth and access-control bugs.
CTF
Web, crypto and forensics. Every solve gets a writeup.
Hardening
Linux servers that stay boring: firewalls, keys-only SSH, TLS done right.
Tooling
Recon automation in Python and Bash.
In progress
Every finding,
documented
Each writeup follows the same structure, so it can be checked and reproduced.
- StatusMarked secured, solved or in progress.
- ScopeWhat was tested, and what was not.
- Reproduction stepsExact commands, in order, copy-pasteable.
- ImpactWhy it matters, in plain words.
- FixHow to close it for good.
Find me
Open to projects, CTF teams and interesting bugs.
Everything I've
written up
Writeups, checklists and notes, collected in one place.
- Hardening nybik.devHiding a fresh VPS behind Cloudflare, locking the origin down and getting TLS to full strict.
- First CTF writeupPlaceholder for the next solved challenge.
- My web recon checklistThe first hour on any web target, step by step.
My web recon checklist
The first hour on any web target, step by step.
First CTF writeup
Placeholder for the next solved challenge.
Hardening nybik.dev
Hiding a fresh VPS behind Cloudflare, locking the origin down and getting TLS to full strict.