In this article, I will share my successful approach to passing the OSCP exam. I primarily focused on Offensive Security labs, mastered a few key tools, and watched tons of techniques to enhance my learning experience.

Emphasizing Offensive Security Labs

Offensive Security provides comprehensive lab environments for OSCP candidates to practice their skills and gain hands-on experience. Instead of spreading my efforts across multiple platforms, I chose to concentrate on the Offensive Security labs. This focused approach helped me achieve better results. The labs provide a controlled environment where I could explore various networks and systems, identify vulnerabilities, and practice exploiting them.

By dedicating my time to the Offensive Security labs, The labs challenged me, pushing my limits and helping me build the skills necessary to tackle the OSCP exam successfully. To be honest the labs were harder than the exam!

Mastering a Few Tools

With a vast array of tools available for offensive security, trying to master all of them can be overwhelming. Instead, I chose to focus on a core set of tools and become proficient in their usage. Here are a few popular tools that I mastered:

1. Nmap

2. Netcat

3. Metasploit (Allowed only for one machine)

4. Burp

5. Mimikatz

6. Impacket

7. CrackMapExec

8. CrackMapExecWin

9. Responder

10. PowerShell Empire

11. Enum4linux

12. Evil-winrm

13. Dirsearch

14. Nikto

15. dirb

16. dirbuster

17. MSFVenom

18. Exploit Databases-

    • Exploit-DB — https://www.exploit-db.com/

    • Windows Kernel Exploits — https://github.com/SecWiki/windows-kernel-exploits

    • AutoNSE — https://github.com/m4ll0k/AutoNSE

    • Linux Kernel Exploits — https://github.com/lucyoa/kernel-exploits

19. Hashcat

20. Ripper

21. Linux Exploit Suggester

22. Windows Exploit Suggester

23. GTFOBins

24. Chisel <3

25. Proxychains

26. Best Site That Helped Me? - https://www.hackingarticles.in/

I used many other tools throughout my labs but these were the major ones I can remember which you should master at least.

During the exam, a valuable strategy was to search for similar labs to those found in the Offensive Security labs using the keyword "Hackthebox" in my search. Sometimes, I came across HTB VMs that mirrored the same vulnerable services as in the exam. This parallel exploration provided additional hints and exposed me to alternative exploitation techniques.

Passing the OSCP exam requires dedication, perseverance, and a strategic approach to training. By focusing primarily on the Offensive Security labs, and mastering a select few tools I significantly enhanced my chances of success.

[ Disclaimer: I could have given a lot more into this but I didn't want to throw a ton of stuff at you which didn't even help me during the exam but yes don't take this as the ultimate thing rather its better to do your own research and get comfortable with the things you prefer and like to work on with ]

What is CI/CD?

Continuous Integration (CI) is a practice of automatically building and testing code changes whenever they are pushed to the code repository. Continuous Deployment (CD) is a practice of automatically deploying code changes to the production environment whenever they pass the CI process. Together, CI/CD pipelines provide an automated process for building, testing, and deploying code changes.

Setting up a Basic CI/CD Pipeline with GitHub

To set up a basic CI/CD pipeline with GitHub, you will need the following:

1. A GitHub account

2. A code repository on GitHub

3. A CI/CD tool (we will be using GitHub Actions)

What are the use cases of CI/CD in cybersecurity?

Almost every security professionals maintain a dedicated server for multiple purposes, It can be bug bounty, enumeration, POC assistance etc. but all of these can be troublesome if every time you had to SSH into the server and update your codes. With CI/CD you can design the entire deployment and how you want the server to behave right from your IDE which is very handy and easy to do.

I have seen people making autonomous recon tools entirely using the GitHub workflow so even that area can be explored.

Steps to set it up

I have used a very basic VPS server to set up a simple CI/CD pipeline, Firstly I SSHed into my VPS and did the steps below:

Generate an SSH key

ssh-keygen -t rsa -b 4096 -C "test@example.com"

Add the public key to the authorized keys

cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

#You can also copy the contents of id_rsa.pub to authorized_keys file

Copy the key

cat ~/.ssh/id_rsa

Go to the "Actions And Secrets Variable" page and setup all these values

• SSH_USERNAME: set the key to the username you use to SSH into your VPS.

• SSH_HOST: set the key to your hostname or ip address.

• SSH_KEY: set the key to you copied contents from the command above.

• SSH_PASS: set the password for the vps

Now navigate to "Actions" page and create a new workflow with this template, This template is to test if you can actually login to the VPS using Github Actions.

name: remote ssh command
on: [push]
jobs:

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
    - name: executing remote ssh commands using password
      uses: appleboy/ssh-action@v0.1.10
      with:
        host: ${{ secrets.SSH_HOST }}
        username: ${{ secrets.SSH_USERNAME }}
        password: ${{ secrets.SSH_PASSWORD }}
        key: ${{ secrets.SSH_KEY }}
        port: 22
        script: |
          whoami

If it's successful then you can go back to your VPS and set up your GitHub credentials there and now instead of "whoami" you can run GitHub operations such as "git pull" to always deploy your code and then run it using the particular command.

For deployment, such templates can be used and deploy your desired application.

name: Deploy Flask App

on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Set up Python 3
        uses: actions/setup-python@v2
        with:
          python-version: 3.8

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt

      - name: Build and test the app
        run: |
          python -m pytest
          python setup.py sdist bdist_wheel

      - name: Deploy to server
        uses: easingthemes/ssh-deploy@v2.1.1
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_KEY }}
          ARGS: "-rltgoDzvO --delete"
          SOURCE: "dist/*"
          REMOTE_HOST: ${{ secrets.SSH_HOST }}
          REMOTE_USER: ${{ secrets.SSH_USERNAME }}
          TARGET: "/var/www/flask_app"

If the repository is private, you will need to set up SSH keys for Git authentication. Here are the steps to follow:

1. Generate an SSH key pair on your Ubuntu machine by running the following command in your terminal:

•   ssh-keygen -t rsa -b 4096 -C "your_email@example.com"
  

  This command will generate a public and private key pair in the ~/.ssh directory on your machine.

• Add the SSH public key to your GitHub account by copying the public key to your clipboard:

•   cat ~/.ssh/id_rsa.pub
  

  This command will print the contents of your public key to the terminal. Copy the entire output.

  Then, go to your GitHub account settings, select "SSH and GPG keys," and click "New SSH key." Paste the contents of your public key into the "Key" field and click "Add SSH key."

• Configure your SSH agent to store your private key:

•   eval "$(ssh-agent -s)"
    ssh-add ~/.ssh/id_rsa
  

  The first command will start the SSH agent, and the second command will add your private key to the agent.

• Clone the private repository using the SSH URL:

•   git clone git@github.com:username/repository.git
  

  Replace username with your GitHub username and repository with the name of the repository you want to clone.

• Once the repository is cloned to your machine, you can perform a git pull to fetch the latest changes from the remote repository:

1.  cd repository
    git pull
   

   This command will update your local repository with the latest changes from the remote repository.

That's it! You should now be able to perform a git pull on your machine for the private repository.

I thought of sharing my OSCP journey and the hurdles I had to overcome to pass this certificate. If you are looking for any learning resources then they will come in the next part, In this part, I will only cover my journey, timeline, and mental preparation.

To start off those who think OSCP is easy and you are not someone who is not a regular HTB/TryHackMe player then you are in for a big surprise.

I thought it would be relatively easy since you are just learning about some tools and using them to enumerate, pivot, escalate, and root. This is what my initial assumption was "UNTIL" I saw this...

So many people were failing OSCP and it hit me quite hard, I was wondering how come so many people are failing it when from my assumption it should be easy. I did more research on it and also talked to the people who failed it and what I understood was all of the cases had a similar pattern.

• Like they failed because they didn't maintain a proper time schedule throughout the exam

• Like they failed because they didn't do many labs

• Like they failed because they did some mistakes while submitting the report

So a similar pattern was "Preparation and Planning"

I believe all these could have easily been avoided if the person had enough preparation and he did enough planning to ace the exam. I'm lucky to realize this beforehand because I had 90 days to complete the labs and then sit for the exam now I need to evaluate if the 90 days are enough for me to go for the exam and after 90 days I only managed to finish around 20 machines that also with the help from Google mostly so I wasn't satisfied at all, It is also hard to push myself to do more labs as I have a fulltime job so I ended up extending my lab period and It helped me a lot because then I managed to solve more than 30+ labs and I was a bit satisfied with my preparation, At the same time I was building labs at my office and testing them also for extra preparation.

And NEVER STOP DOING NOTES, they are life savers. Make sure you note down everything and special scenarios also to help you with those special cases.

I knew AD will be there in the exam so I didn't take any risk with the AD and learned the simplest tools and easiest ways to take control of an AD, I planned to keep things simple and to make sure I spend less brain power on tools and more brain power on planning the attack, So I wouldn't choose any tools that require sophisticated steps rather I will research the tools and if I find something easy to use I will stick with it.

After all these, I realized that people who fail OSCP are not because they are less skilled or knowledgable but because they prepared less for the exam. To be honest, I also didn't think I will pass it on the first attempt since the exam was completely changed this year and the tips I was getting were old since most of my friends and connections passed the old version, So I had the challenge to overcome and plan the entire thing myself. In the end, Confidence is the key that worked out for me.

OSCP EXAM DAY

Funny Story: As I was showing my room to the proctor he asked me to take down my TV and face it towards the wall, It made me laugh because it wasn't even powered on and it was quite heavy, I did tell him that it is very heavy I will need some time to do that. He said no problem do it!

7.00 AM: I sat for the exam and was quite nervous. I spent 20 minutes understanding the requirements and the environments, made sure I could ping all the machines and before starting my first machine I reverted it just to double confirm that the machine will be fresh.

12:00 PM: I managed to pwn my first machine in AD before this I didn't take any breaks and I was constantly focused on this machine due to my nervousness. This gave me the realization that if I continue to sweat like this and lose all my focus I will not be able to use my full potential on the other machines, So I will have to balance it out.

I took a hot shower after this and a good lunch, Took some rest, and also planned a few things in my head before restarting.

2:00 PM: I managed to pwn my second machine and I was so happy because my trick was working and I was taking constant breaks, It helps you SOOOOOO much to cool down and think of other ways to get inside the machine.

[Throughout this period I was having fruits and healthy snacks to keep my strength up and to feel energetic ]

3:00 PM: I managed to complete the entire AD and I couldn't be anymore happier than this, At this stage, I had enough confidence to ace the exam because I knew I had the time and resources now to push forward.

5:00 PM: Managed to get local privilege on the first standalone machine and after this decided to go for a walk and get an Ice cream, Rewarding myself for such achievement was also working a lot. Had a nice dinner with a tasty dessert and restarted my exam.

9:00 PM: Managed to root my first standalone machine. At this point, I was already noticing fatigue and I started to push myself even more.

2:00 AM: Managed to get the local privilege of the second standalone machine and at this stage, I was completely done, My head was screaming to go to sleep and asking me to give it a rest. Since I ensured 70 I didn't push myself anymore and went to sleep happily knowing that I also have a lab report to submit so in total I will have 80 points and will pass it quite easily.

So then I just waited for the final email and then, it arrives...

GOLDEN TIPS

• DO NOTES!

• Don't be lazy with the labs and exercises!

• During the exam, if you are completely stuck on a machine then search about that specific service in google but add the keyword "hack the box", If you are lucky HTB will have a similar box with that service from where you can take new ideas to get the initial shell.

• If possible keep a separate terminal just for enumerating, Take a good wordlist and start enumerating. Sometimes you might get lucky and end up inside some user's account since the password would be quite easy to guess like "john"

• Don't change your plan frequently it will lead to burnout, Instead do an initial enumeration and choose the attack plan you are comfortable with and can escalate to an advanced level.

• If you find an exploit not running and giving errors, most probably that's intended. Try to look into the code and fix it if necessary or look for alternatives in GitHub if someone had already fixed it.

• For python, if you are running some tools on your local kali for the sake of god use virtualenv, This fella saved me from so many troubles.

When a digital signature is created, a hash is generated using a cryptographic algorithm and is specific to the document being signed. This hash, along with other signature information, is then embedded in the document. When the document is received by someone else, the signature can be verified using the sender's public key to confirm that the document has not been tampered with and that it was indeed signed by the person or organization that it claims to be signed by.

Digital signatures can be used to verify the authenticity of downloaded files in several ways:

1. By checking the file's digital signature: If the file has a digital signature from a trusted source, it is likely to be authentic.

2. By using the software's built-in signature verification tools: Many software programs, such as Adobe Acrobat or Microsoft Word, have built-in mechanisms for verifying digital signatures. These tools will typically allow you to check the signature, view the certificate information, and ensure that the signature is valid and the document has not been tampered with.

3. By using online verification: Some organizations or websites provide online verification tools that can be used to check the validity of a digital signature.

4. Using open-source libraries: Some open-source libraries like OpenSSL, GnuPG, etc. can be used to verify digital signatures on a command-line interface.

It's important to note that while digital signatures can help ensure the authenticity of a downloaded file, they do not guarantee the safety or accuracy of the content of the file. Additionally, digital signatures can be forged, and it is important to verify the authenticity of the signature itself, and not just rely on the signature present.

Example:

Let's say we download "Py Charm" from this link: https://www.jetbrains.com/pycharm/download/#section=windows

And after we download the exe file, We go to the location of the file and check the properties

We notice that in the properties section, there is something called "Digital Signatures" and when we open that section we can see that JetBrains actually signed this file with their certificate.

Now we download the same file from Softonic

So how do we know that Softonic didn't just add their malware into it and it could be a completely different file right?

After the download finishes, we can check the properties again and see that this is also been signed by JetBrains

So this is how you can verify if the file you downloaded is authentic or not.

In conclusion, Digital Signatures provide an additional layer of security when it comes to verifying the authenticity of downloaded files, it's important to use multiple methods to ensure that you are downloading a secure file and always verify the authenticity of the signature itself.

So why am I sharing it now? I didn't get permission to disclose it at that time but I think since the issue still exists in the wild, we should talk about it.

This happened when I was receiving too many emails from a particular company and I wanted to unsubscribe from their newsletter, So I noticed the "Unsubscribe Button" and basically unsubscribed from the newsletter. But few things were stuck in my mind when I visited the unsubscribe page, they are:

1. It had information such as my email, address, and phone number
2. And the unsubscribe token was more like a tracking token also which was getting used throughout the website. (How did I know? Because the moment I went to their homepage from the unsubscribe page the token also followed along)

After a few days, I was trying to understand and study the cloudbleed issue and then it came to my head that I can try my luck there on that unsubscribe page since it was also throwing the token everywhere then technically it should also be leaking somewhere.

My first plan was to find the company behind that marketing software because I knew companies wouldn't allow third-party branding for their own usage. Luckily that company using the marketing software was in hackerone so by risking my reputation knowing it's an out-of-scope vulnerability I still reported it to know what software they used. Because my strategy of going through HTML source codes to find any traces of the software didn't help much so this was the only option.

So basically I reported an issue to the company based on my 2nd observation, saying that it was leaking the token to social media sites because that page also had links to their twitter/facebook pages so when I clicked on it the token was also getting captured there by those social media sites.

And the unsubscribe token was more like a tracking token also which was getting used throughout the website. (How did I know? Because the moment I went to their homepage from the unsubscribe page the token also followed along)

And it worked! We got the company!

After knowing the company name I was quite shocked to find out that it was one of the leading marketing software at that time and even they were getting ready to be acquired by Adobe. So after this, I instantly knew if I find any issue regarding this it will affect a massive userbase. That just motivated me even more to find something in it, I was working for days to find out how I can leak the token at a mass level, and then it hit me, Why am I trying to leak it? Since the token gets tied to any URL user visits, it should get archived or cached by something somewhere.

First guess? Obviously! Google!

So google was giving us 50k+ results for the tokens but it got interesting when I searched it on bing.

(Sorry for the blurry screenshot, this is the only photo I had to proof the bing results)

I was getting 500k+ results on bing, I think google was restricting a lot of results due to region and other settings but seeing the results on bing convinced me that yes this is something that needs to be reported.

I directly reached out to the CISO of the company on linkedin and he was a nice guy who instantly connected back to me and we had few meetings and then they decided to fix the issue. Even though they didn't have any bug bounty program they decided to reward me still.

By the way, I never managed to use the money on that card because it would only work in the US but did I make any money out of it?

Well, yes I did. Because the CISO told me they implemented a new configuration where users can choose to not leak that token and I knew what to do then, Just find the vulnerable ones which are misconfigured and report them.

Voila...

And Many more...

Let's say most of my earnings for "Information Disclosure" came from this one "Unsubscribe Tragedy" because it only takes 2-3 minutes to find and report.

In this context, availability refers to a commitment that the information will be dependable for use by authorized individuals, integrity refers to the assurance that the information is trustworthy and accurate, and confidentiality refers to a system of rules that restrict access to information.

Confidentiality

Special training for those who have access to sensitive documents is often required to protect data confidentiality. Authorized individuals can benefit from training to become more familiar with risk factors and preventative measures. Strong passwords, password-related best practices, and knowledge of social engineering techniques are possible additional components of training to deter users from violating data handling policies with good intentions and potentially devastating outcomes.

Requiring an account number or routing number while banking online is a good illustration of a strategy used to protect confidentiality. Another popular technique for protecting confidentiality is data encryption. Two-factor authentication (2FA) is starting to replace the conventional practice of using user IDs and passwords. Security tokens, key fobs, and biometric verification are other choices.

Documents that contain highly sensitive information may require additional security precautions, such as storage solely on air-gapped computers, disconnected storage devices, or in physical copy form.

In Short:

• Data should be handled based on the organization's required privacy.
• Data should be encrypted using 2FA.
• Keep access control lists and other file permissions up to date.

Integrity

These security measures include user access restrictions and file permissions. Version control can be used to stop authorized users from making mistakes or accidentally deleting things. Organizations must also provide some method for detecting any data changes that can happen from non-human events like an electromagnetic pulse (EMP) or server crash.

Checksums, including cryptographic checksums, may be used in data to verify its integrity. To restore the impacted data to its original condition, backups or redundancies must be accessible. Additionally, by using digital signatures to provide effective protection, it is impossible to dispute the evidence of logins, messages transmitted, and the reading and sending of electronic documents.

In Short:

• Ensure employees are knowledgeable about compliance and regulatory requirements to minimize human error.

• Use backup and recovery software.

• To ensure integrity, use version control, access control, security control, data logs and checksums.

• Ensure nobody can modify data without proper authorization.

Availability

The best ways to do this are to keep all hardware under strict maintenance, fix any hardware issues as soon as they arise, and maintain a stable OS environment free of software conflicts. Additionally, it's critical to stay up to date on all required system upgrades. Equally crucial strategies include ensuring sufficient communication capacity and avoiding bottlenecks. When hardware problems do arise, redundancy, failover, RAID, and even high-availability clusters can help to prevent major repercussions.

For the worst-case scenarios, quick and adaptable disaster recovery is crucial; this capability depends on the presence of a thorough DR plan.

In Short:

• Use preventive measures such as redundancy, failover and RAID. Ensure systems and applications stay updated.

• Use network or server monitoring systems.

• Ensure a data recovery and business continuity (BC) plan is in place in case of data loss

• Ensure that nothing takes down the server

Requirements To Build Your Own Recon Dashboard

For this, I will be recommending python since I'm guessing you are completely new to building dashboards.

• Python3 (Basics related to scraping, async coding, subprocess, and formatting outputs)
• FLASK
• FASTAPI
• MongoDB (No SQL Database)

Python is easy to learn and FLASK is for fast development which gives you the power to build something quite faster than traditional languages or frameworks. I usually design an idea diagram of the whole program and then start writing code to turn the idea into reality.

We can deploy the open-source bug bounty/pentest recon tools using subprocess and launch them in FASTAPI to reduce the load in the main application. After that, you can focus on fetching and extracting various data, especially JSON to gather data from these microservices.

FREE FLASK Templates For Dashboard

You can use all these free FLASK templates to build your dashboards:

• https://github.com/app-generator/flask-dashboard-azia
• https://github.com/app-generator/boilerplate-code-flask-dashboard
• https://github.com/app-generator/flask-soft-ui-dashboard

Now all you need to do is just plug and play, Deploy the tools using FASTAPI and capture them using your FLASK application to populate your dashboard.

So what do you do? Give up? Well since everyone is focusing on enumerating subdomains we can actually look at related domains.

What are related domains?

Related domains are basically registered domains by the companies but they are just not mentioned in the scope. But these are active domains in production that are maybe responsible for running other services so if you take them over you could also takeover active services.

How to takeover related domains?

I have built a platform called SNIFFCON which has a subdomain scanner that actually looks for such related domains and gives output like this:

But you can also find related domains here: https://otx.alienvault.com/indicator/domain/media.net

As you can see OTX provides a lot of false-positive results for related domains but SNIFFCON managed to find the actual domain that belongs to that company.

After identifying the related domains you need to find the domain expiry date because usually, companies forget to renew these low priority domains and expose themselves to critical vulnerabilities because some of the servers might try to communicate with that expired domain. Attackers can implement a TCP dumper in the website to start capturing sensitive data.

SNIFFCON has a whois monitoring tool that allows you to monitor these domains and alerts you when they are expired so you will need something like that to start taking over these related domains as soon as they get dropped.

So there are three ways we can reverse an array in python,

1. Slicing

We can use slicing to turn any normal list array into a reverse list array.

list = [1,2,3,4]
print(list[::-1])

Result: 4,3,2,1

How does slicing work?

Slicing has three values start stop and step which makes it easier for us to reverse the list here. Some of the examples for slicing would be:

list[start:stop]  # items start through stop -1
list[start:]      # items start through the rest of the array
list[:stop]       # items from the beginning through stop -1
list[:]           # a copy of the whole array
list[start:stop:step] # start through not past stop, by step

To make it easier we can look at this diagram below where positive values mean sequential increment and negative values mean the complete opposite.

As you can see we only used step here list[::-1] in our code to reverse the array and that is because this step works with items from first to last and the amount you put are the steps it will take, for example, if we put this list[::2] it will print only 1 and 3 because the step started from 1 and then skipped 1 and 2 and found 3 so it shows 1 and 3!

Now if you put this list[::1] it will show the all 1,2,3,4 because it is taking 1 and then taking one step and finding 2 then again another step finding 3 this way it will continue.

So now if we list[::-1] put this it goes to the last items and starts from there so the whole list gets reversed!

2. Reverse()

Python has a built-in method reverse() that automatically reverses the order of the list arrays right at the original place.

list = [1,2,3,4] 
print(list)
list.reverse()

Result: 4,3,2,1

3. Reversed()

Another similar method is there which is reversed() when passed with a list returns an iterable in reverse order.

arr_list = [1,2,3,4] 
print(list(reversed(arr_list)))

Result: 4,3,2,1

So as I was building this app I realized that even though I used threading (Which is a bad idea to replace async tasks with) inside the application to easily bypass some of these issues it still didn't solve what I wanted. So basically this was the scenario my application was working fine until I realized that all the view functions are not asynchronous at all, If one page was loading then the other page wouldn't load until that was finished which was a complete disaster because it will make the application very slow.

I started asking my friends they suggested me to use queues , celery or other similar projects to do asynchronous tasks smoothly but I had my security scanner developed already and didn't want to add things back to it again so I started looking for solutions and came across gunicorn which gave the exact result I wanted.

So Gunicorn has something called workers which works asynchronously and by spawning 5-6 such workers I achieved complete asynchronous functionality for the view functions in flask.

Gunicorn Commands:

If you used threading use this:

gunicorn --workers=5 --threads=10 --worker-class=gthread app:app

If you want to use gevent use this:

gunicorn --worker-class=gevent --worker-connections=1000 --workers=5 app:app

Note: You don't have to launch more than 10-12 workers as it is mentioned in the documentation that 5-6 such workers can easily handle thousands of requests so use them wisely.

Basically, I was able to bypass the grab food’s payment mechanism and it was a serious issue, Imagine ordering foods for free. No more business for grab, so it was closed as a very severe bug and because of its impact grab was kind of forced to shut down the entire service for it and they paid 10000$ upon verifying the issue and another 1000$ later.

Grab acted very responsible in this manner and was very quick with the bounty also I found a similar issue with Grab’s ride application where you can have unlimited rides but unfortunately it was known to them. After my first report and they still paid 1k$ for that which was really generous of them. Moreover, I was also asked to send my resume because of that bug but I had to reject it due to my studies at that time.

The best part about this whole experience was due to some miscommunication grab actually reached out to @nahamsec to join our conversation so that we can clear things up from both sides which was quite fascinating for me.

My Hackerone Profile: h33t