https://zakhwananuar.my/blog.html Notes and thoughts on cybersecurity, CTF, and building security tools. en Mon, 14 Sep 2026 18:06:59 +0000 https://zakhwananuar.my/blog-post.html?id=chameleon-wifi-esp32 https://zakhwananuar.my/blog-post.html?id=chameleon-wifi-esp32 Wed, 01 Jul 2026 00:00:00 +0000 A captive-portal / rogue-AP research tool that runs entirely on a $10 ESP32-S3 and is driven from your phone. Here is how the firmware actually works — the DNS hijack, the soft-AP, credential capture, and flash-persisted config. https://zakhwananuar.my/blog-post.html?id=discord-c2-dump https://zakhwananuar.my/blog-post.html?id=discord-c2-dump Wed, 01 Jul 2026 00:00:00 +0000 Malware increasingly uses Discord as a command-and-control channel. When you pull a bot token and guild ID out of a sample in the lab, this Python tool walks the Discord REST API to dump everything the bot can see and scan it for IOCs. https://zakhwananuar.my/blog-post.html?id=building-bad-usb https://zakhwananuar.my/blog-post.html?id=building-bad-usb Wed, 01 Jul 2026 00:00:00 +0000 A Raspberry Pi Pico running CircuitPython that enumerates as a USB HID keyboard and runs a DuckyScript payload — a full breakdown of the boot-time USB toggle, the payload parser, the key map, and the GP0 arming logic. https://zakhwananuar.my/blog-post.html?id=csm-cyberjaya-visit https://zakhwananuar.my/blog-post.html?id=csm-cyberjaya-visit Wed, 01 Jul 2026 00:00:00 +0000 My final event leading the MBOT UNITEN Student Chapter — a visit to CyberSecurity Malaysia in Cyberjaya, and a reflection on growth, leadership, and becoming someone new. https://zakhwananuar.my/blog-post.html?id=cybershield-summit-2026 https://zakhwananuar.my/blog-post.html?id=cybershield-summit-2026 Wed, 01 Jul 2026 00:00:00 +0000 How one simple conversation led to speaking at a national-level cybersecurity summit — sharing CTF, cybersecurity, and the Malaysia Board of Technologists with 360+ students across the country. https://zakhwananuar.my/blog-post.html?id=mbot-coderush-2026 https://zakhwananuar.my/blog-post.html?id=mbot-coderush-2026 Wed, 01 Apr 2026 00:00:00 +0000 No code, no competition results. Just a reflection on stepping back, trusting others, and discovering that the best leadership sometimes means giving others the space to lead. https://zakhwananuar.my/blog-post.html?id=scholarship-journey https://zakhwananuar.my/blog-post.html?id=scholarship-journey Wed, 01 Apr 2026 00:00:00 +0000 No CTF, no cybersecurity. Just an email that brought me back to one of the hardest chapters of my life — rejections, pressure, guilt, and eventually, peace. https://zakhwananuar.my/blog-post.html?id=micromanagement-trap-leadership https://zakhwananuar.my/blog-post.html?id=micromanagement-trap-leadership Wed, 01 Apr 2026 00:00:00 +0000 A reflection from my conversation with a colleague at Southeast Asia Sustainable Environmental Leadership Program 2025 (SEASEL'25) on why micromanaging erodes trust — and what it really means to lead with confidence instead of control. https://zakhwananuar.my/blog-post.html?id=my-first-ctf-experience https://zakhwananuar.my/blog-post.html?id=my-first-ctf-experience Sun, 01 Mar 2026 00:00:00 +0000 I thought my first CTF would be like in the movies. It was not. But I learned more in 48 hours than in weeks of studying. https://zakhwananuar.my/blog-post.html?id=tools-i-actually-use https://zakhwananuar.my/blog-post.html?id=tools-i-actually-use Sun, 01 Feb 2026 00:00:00 +0000 A no-fluff list of the tools that actually end up in my CTF workflow — with honest notes on when they're useful and when they're not.