These notes are public, opinionated, and evolving — read abdelkader.ma for the long-form posts.

Abdelkader.notes

Home abdelkader.ma →GitHub →

Knowledge base
- Overview
- Type confusion
- Type Juggling
- Magic Hash Bypass
- in_array Strict Mode
- strcmp() Array Injection
- intval() Bypass
- strpos() == false Bug
- Variables & scope
- extract() Variable Injection
- Dynamic Variables ($$)
- Deserialization
- unserialize() Object Injection
- PHAR Deserialization
- Injection
- SQL Injection
- Command Injection
- Local File Inclusion
- Remote File Inclusion
- Path Traversal
- File Upload
- HTTP & network
- SSRF
- Host Header Poisoning
- Open Redirect
- Auth logic
- Auth & Authz Review
- Overview
- Recon Checklist
- Overview
- Web Challenge Methodology
- Overview
- Privileged Accounts Checklist
- Overview
- SNMP Default Community Strings
References
- Overview
- Burp Suite Notes
- Overview
- Common Web Payloads
- Overview
- Overview
Elsewhere

On this page

Pages

Edit this page on GitHub →

ToolsOverview

Tools

Not a list of “every tool that exists.” A list of tools I have used enough to have opinions about.

Pages

Burp Suite Notes

SNMP Default Community Strings Burp Suite Notes

© 2026 Abdelkader Belcaid · Mohammed Belcaidabdelkader.ma · github · ping@abdelkader.ma