Projects on Njeru Mtwaiti

sqli-hunter

Thu, 15 May 2025 00:00:00 +0000

A purpose-built SQL injection detection and exploitation tool designed for web application pentesting engagements. Lighter and more scriptable than sqlmap for targeted assessments.

Capabilities:

Error-based injection detection across common databases (MySQL, PostgreSQL, MSSQL, SQLite)
Boolean-based blind injection with binary search
Time-based blind injection with adaptive delay tuning
Cookie, header, and POST body injection points
Simple CLI interface for quick integration into recon pipelines

Tech: Python, requests, argparse

Intended for authorized security testing only.

CTF Writeups Repository

Tue, 01 Apr 2025 00:00:00 +0000

A growing collection of detailed writeups from CTF competitions and platform boxes. Each writeup covers the full attack chain: enumeration → exploitation → privilege escalation → flags.

Organized by platform and difficulty. I write these both to solidify my own understanding and to give back to the community that taught me.

Platforms covered:

HackTheBox (Easy / Medium / Hard)
TryHackMe learning paths
CTFtime competition events
PicoCTF challenges

Categories: Web, Binary Exploitation, Cryptography, Forensics, Reversing, OSINT

recon-toolkit

Sat, 01 Mar 2025 00:00:00 +0000

A modular recon automation framework that chains together passive and active discovery techniques — subdomain brute-forcing, DNS resolution, HTTP probing, port scanning, and screenshot capture — into a single pipeline.

Features:

Passive subdomain discovery via crt.sh, Shodan, and VirusTotal APIs
Active DNS brute-force with custom wordlists
HTTP service detection and technology fingerprinting
Automated screenshot capture of live hosts
Output to structured JSON and HTML reports

Tech: Python, asyncio, aiohttp, dnspython, Shodan API