Baba Yaga's Corner

A deep dive into building RedTeam Phish Suite — my graduation project and the most technically involved thing I ve built. A full-stack phishing simulation platform that uses OSINT and AI to generate personalized spear-phishing emails per target. From surviving 9 attempts to scrape LinkedIn (and failing 8 times), to a Chrome extension that finally worked, to a dual Red Team / Awareness mode with real-time tracking — this is everything I built, broke, and learned.

How We Solved Challenges We Never Opened ? or Who Said You Have to Open the Challenge First ?

An OSINT investigation starting from a single ransom image left on a Node.js developer machine. Trace the attacker across all platforms to uncover an attack via a malicious npm package.

Extracting a hidden flag image by exfiltrating binary data over DNS queries using hex encoding and interactsh.

Exploiting CSS injection and command injection to bypass CSP and steal admin API keys, leading to full system compromise in a web challenge.

A comprehensive guide to JWT (JSON Web Token) vulnerabilities and attacks including signature bypass, algorithm confusion, and header parameter injections.