Posts on SANMATTEhttps://sanmatte.xyz/posts/Recent content in Posts on SANMATTEHugo -- gohugo.ioen-usMon, 20 Jul 2026 00:00:00 +0000Style Showcase — Code & Syntaxhttps://sanmatte.xyz/posts/2026/07/style-showcase-code-syntax/Mon, 20 Jul 2026 00:00:00 +0000https://sanmatte.xyz/posts/2026/07/style-showcase-code-syntax/<p>A throwaway post to preview every rendering element: headings, inline code, fenced blocks with syntax highlighting, blockquotes, lists, tables and links. Use it to judge colors before we change anything.</p> <h2 id="heading-level-2">Heading level 2</h2> <p>Some prose with <code>inline code</code> in the middle, a <a href="https://example.com">normal link</a>, and a bit of <strong>bold</strong> plus <em>italic</em> text. Here is a longer inline token like <code>GET /admin?id=1 UNION SELECT flag FROM secrets</code> to see how inline code wraps.</p>A throwaway post to preview every rendering element: headings, inline code, fenced blocks with syntax highlighting, blockquotes, lists, tables and links. Use it to judge colors before we change anything.

Heading level 2

Some prose with inline code in the middle, a normal link, and a bit of bold plus italic text. Here is a longer inline token like GET /admin?id=1 UNION SELECT flag FROM secrets to see how inline code wraps.

Heading level 3

Heading level 4

Blockquote: “The quieter you become, the more you are able to hear.” Payloads should be reproducible, not lucky.

Shell

#!/usr/bin/env bash
# quick port sweep + banner grab
set -euo pipefail

TARGET="${1:?usage: sweep <host>}"
for port in 22 80 443 8080; do
  if timeout 1 bash -c "echo > /dev/tcp/${TARGET}/${port}" 2>/dev/null; then
    echo "[+] ${TARGET}:${port} open"
    curl -s "http://${TARGET}:${port}" | head -n 1
  fi
done

Python

import requests

def brute(url: str, wordlist: list[str]) -> str | None:
    """Return the first path that doesn't 404."""
    for word in wordlist:
        r = requests.get(f"{url}/{word}", timeout=3)
        if r.status_code != 404:
            print(f"[+] found: /{word} ({r.status_code})")
            return word
    return None  # nothing found

if __name__ == "__main__":
    brute("http://target.local", ["admin", "backup", ".git", "flag.txt"])

C

#include <stdio.h>
#include <string.h>

int vuln(char *input) {
    char buf[64];
    strcpy(buf, input);          // no bounds check
    return printf("got: %s\n", buf);
}

int main(int argc, char **argv) {
    if (argc < 2) { fprintf(stderr, "need arg\n"); return 1; }
    return vuln(argv[1]);
}

HTTP request

POST /login HTTP/1.1
Host: target.local
Content-Type: application/json
Cookie: session=deadbeef

{"user":"admin","pass":"' OR '1'='1"}

JSON

{
  "user": "root",
  "roles": ["admin", "operator"],
  "authenticated": true,
  "token": null,
  "attempts": 3
}

SQL

SELECT username, password_hash
FROM   users
WHERE  role = 'admin'
  AND  last_login > NOW() - INTERVAL '7 days';

Plain / unlabeled block

$ whoami
root

A table

Tool Purpose Speed
nmap port scanning medium
ffuf content discovery fast
sqlmap injection slow

Lists

  1. Enumerate the surface
  2. Find the bug
    • memory corruption
    • logic flaw
    • injection
  3. Weaponize
  4. Report
]]>