Skip to content
ProjectMerai

Research

The work, written down

Vulnerability research, methodology, and tool internals from ProjectMerai and the GhostVirus byline. Written to be read, not skimmed.

CVE8 min read

Five Critical RCEs in Dokploy: one bad habit, five open doors

Five CVSS 9.9 command-injection bugs in Dokploy, the self-hosted PaaS. Same mistake, five different features, five authenticated paths to running whatever you want on the box.

Read
Explainer4 min read

DLL Hijacking Explained to a 10yr Old

How the Windows loader actually resolves a DLL — LdrLoadDll, the KnownDLLs check, and the search order — and exactly where in that sequence a hijack becomes possible.

Read
Writeup4 min read

How I Got a P3 in NASA

A beginner-friendly walkthrough of the recon, the dead ends, and the single misconfiguration that turned weeks of P5s into a valid P3 and a letter of recognition from NASA.

Read
Guide10 min read

All About API Hacking

A practical tour of API testing: recon and endpoint discovery, documentation and mass assignment, BOLA and broken authentication, rate limiting, and where to practise it safely.

Read