https://ishbarnakafle.com.np/Security research, vulnerability research, CTFs, responsible disclosure and technical writeups. 2026-09-30T23:00:36+05:45 Ishbarna Kafle https://ishbarnakafle.com.np/ Jekyll © 2026 Ishbarna Kafle /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-09-23T00:00:00+05:45 2026-09-23T00:00:00+05:45 https://ishbarnakafle.com.np/posts/base64-unauthenticated-sql-injection/ Ishbarna Kafle

Intigriti’s September Challenge : Challenge 0926 I almost skipped this challenge. Intigriti’s Challenge 0926 was just a page that showed you a picture of an animal based on a URL parameter. Doesn’t sound like much. Turns out, that one little parameter had a full unauthenticated SQL injection hiding in it and it took me straight to the flag. Challenge: Intigriti Challenge 0926 Here’s th...

2026-09-15T00:00:00+05:45 2026-09-15T00:00:00+05:45 https://ishbarnakafle.com.np/posts/unauthenticated-idor-user-pii-rbac/ Ishbarna Kafle

Everyone’s out here chasing live targets. Meanwhile I’m digging through an archived repo nobody’s touched in months, because why not. So naturally that’s where I went looking. Turned out to be worth it. — — — — — — — — — — — — — — — — — — — — — — — — — — — — — Let’s call it example.com The program listed the API repo as in-scope source, even though it’s archived on GitHub now. Archived repo...

2026-03-07T00:00:00+05:45 2026-03-07T00:00:00+05:45 https://ishbarnakafle.com.np/posts/ohsint-tryhackme-walkthrough/ Ishbarna Kafle

Introduction Open Source Intelligence (OSINT) is the process of collecting and analyzing publicly available information from sources such as websites, social media, public records, and online platforms. In cybersecurity, OSINT is commonly used during the reconnaissance phase to gather information about a target before deeper security testing. Platforms like TryHackMe provide practical challen...