Skip to content
View chillyka0x1's full-sized avatar
:atom:
:atom:

Block or report chillyka0x1

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
chillyka0x1/README.md

Adrian Bork

Offensive security · Munich, Germany

I break web applications to understand how they're built — and write up every technique in my own words.


TryHackMe League Rooms eJPT FISI


If I can't explain why an attack lands without naming a tool, I don't consider it learned.


🎯 What I work on

Injection

SQL Injection NoSQL LDAP ORM SSTI XXE Command Injection

Authentication & session

JWT OAuth MFA Bypass Session Management Auth Bypass

Access control & logic

IDOR SSRF XSS File Inclusion Race Conditions Mass Assignment

Tooling

Burp Suite nmap sqlmap gobuster ffuf hashcat John the Ripper Wireshark Metasploit Kali Python


Next up — Linux & Windows privilege escalation → Active Directory


🧠 The pattern underneath

Every one of those is the same question in different syntax: does the server trust a value I control?

Attack The assumption it breaks
SSTI The server evaluates my input instead of displaying it
SQL / NoSQL My input becomes part of the query instead of staying data
LDAP I can close the filter and inject my own condition
ORM The developer reached past the ORM into raw SQL
XXE The parser will fetch whatever I point it at
JWT The server trusts a token it should be verifying
IDOR The reference is accepted, not authorised

📦 Repositories

pentest-writeups

Attack techniques in my own words — the mechanism and the mistakes, not the answers.

Plus the checklist I work through before opening a walkthrough.

periscan

Exposure scanner in Python.

Shows what's actually reachable from outside. On its first run it found an accidentally exposed Proxmox — which is why it exists.

homelab-infrastructure

Proxmox lab: 22+ services, OPNsense segmentation, monitoring.

Targets I'm allowed to break.

🔬 How I learn

The loop
  1. Solve it — hands-on, no walkthrough if I can avoid it
  2. Explain it from memory — closed notes. Recognition isn't recall.
  3. Write down what I got wrong — the misconception is the part that sticks
  4. Revisit on a schedule — spaced repetition, because knowledge decays

Every writeup follows that shape: when it applies · why it works · how to test it · what it looks like · how to fix it · what I got wrong.

The last section is the one I'd read first.

Background

Linux since my early twenties, first server and OPNsense firewall at 26, nine years in the trades — then all-in on security in December 2025. Currently training as an IT Systems Integration specialist (FISI, IHK).

I ran systems before I attacked them. That order helps: you reason about attack surface differently once you've had to keep something alive, patch it, and watch it fall over at 2am.


🗺️ Roadmap

Milestone Target
eJPT Q4 2026
HackTheBox — OSCP preparation 2027
OSCP 2028
FISI — IT Systems Integration, IHK until Q4 2027

📫 borkadrian@proton.me

Learning in public. Everything here is my own work — anything borrowed is credited.
All testing on authorised targets only: my own lab, TryHackMe, HackTheBox, and intentionally vulnerable applications.

Pinned Loading

  1. pentest-writeups pentest-writeups Public

    Web application attack techniques in my own words - the mechanism and the mistakes, not the answers

  2. periscan periscan Public

    Exposure scanner in Python - see what is actually reachable from outside your network

    Python

  3. homelab-infrastructure homelab-infrastructure Public

    My Proxmox practice lab: 22+ services, OPNsense segmentation, monitoring - targets I am allowed to break