https://saifsalah.github.io/

1<!DOCTYPE html><html lang="en" > <!-- The Head v2.0 https://github.com/cotes2020/jekyll-theme-chirpy © 2017-2019 Cotes Chung MIT License --><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><title>S41F</title><meta name="generator" content="Jekyll v3.10.0" /><meta property="og:title" content="S41F" /><meta name="author" content="Saif Salah" /><meta property="og:locale" content="en_US" /><meta name="description" content="software development,Software Engineering web app sec, security code review, red team penetration testing, malware development" /><meta property="og:description" content="software development,Software Engineering web app sec, security code review, red team penetration testing, malware development" /><link rel="canonical" href="https://saifsalah.github.io/" /><meta property="og:url" content="https://saifsalah.github.io/" /><meta property="og:site_name" content="S41F" /><meta property="og:type" content="website" /><meta name="twitter:card" content="summary" /><meta property="twitter:title" content="S41F" /><meta name="twitter:site" content="@6675636b6f6666" /><meta name="twitter:creator" content="@Saif Salah" /><meta name="google-site-verification" content="google_meta_tag_verification" /> 

1<script type="application/ld+json"> {"@context":"https://schema.org","@type":"WebSite","author":{"@type":"Person","name":"Saif Salah"},"description":"software development,Software Engineering web app sec, security code review, red team penetration testing, malware development","headline":"S41F","name":"Saif Salah","sameAs":["https://twitter.com/6675636b6f6666","https://github.com/saifsalag"],"url":"https://saifsalah.github.io/"}</script>

1 <!-- The Favicons for Web, Android, Microsoft, and iOS (iPhone and iPad) Apps Generated by: https://www.favicon-generator.org/ v2.0 https://github.com/cotes2020/jekyll-theme-chirpy © 2019 Cotes Chung Published under the MIT license --><link rel="shortcut icon" href="/assets/img/favicons/favicon.ico" type="image/x-icon"><link rel="icon" href="/assets/img/favicons/favicon.ico" type="image/x-icon"><link rel="apple-touch-icon" href="/assets/img/favicons/apple-icon.png"><link rel="apple-touch-icon" href="/assets/img/favicons/apple-icon-precomposed.png"><link rel="apple-touch-icon" sizes="57x57" href="/assets/img/favicons/apple-icon-57x57.png"><link rel="apple-touch-icon" sizes="60x60" href="/assets/img/favicons/apple-icon-60x60.png"><link rel="apple-touch-icon" sizes="72x72" href="/assets/img/favicons/apple-icon-72x72.png"><link rel="apple-touch-icon" sizes="76x76" href="/assets/img/favicons/apple-icon-76x76.png"><link rel="apple-touch-icon" sizes="114x114" href="/assets/img/favicons/apple-icon-114x114.png"><link rel="apple-touch-icon" sizes="120x120" href="/assets/img/favicons/apple-icon-120x120.png"><link rel="apple-touch-icon" sizes="144x144" href="/assets/img/favicons/apple-icon-144x144.png"><link rel="apple-touch-icon" sizes="152x152" href="/assets/img/favicons/apple-icon-152x152.png"><link rel="apple-touch-icon" sizes="180x180" href="/assets/img/favicons/apple-icon-180x180.png"><link rel="icon" type="image/png" sizes="192x192" href="/assets/img/favicons/android-icon-192x192.png"><link rel="icon" type="image/png" sizes="32x32" href="/assets/img/favicons/favicon-32x32.png"><link rel="icon" type="image/png" sizes="96x96" href="/assets/img/favicons/favicon-96x96.png"><link rel="icon" type="image/png" sizes="16x16" href="/assets/img/favicons/favicon-16x16.png"><link rel="manifest" href="/assets/img/favicons/manifest.json"><meta name='msapplication-config' content='/assets/img/favicons/browserconfig.xml'><meta name="msapplication-TileColor" content="#ffffff"><meta name="msapplication-TileImage" content="/assets/img/favicons/ms-icon-144x144.png"><meta name="theme-color" content="#ffffff"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin="anonymous"><link rel="dns-prefetch" href="https://fonts.gstatic.com"><link rel="preconnect" href="https://www.google-analytics.com" crossorigin="use-credentials"><link rel="dns-prefetch" href="https://www.google-analytics.com"><link rel="preconnect" href="https://www.googletagmanager.com" crossorigin="anonymous"><link rel="dns-prefetch" href="https://www.googletagmanager.com"><link rel="preconnect" href="cdn.jsdelivr.net"><link rel="dns-prefetch" href="cdn.jsdelivr.net"><link rel="preload" as="style" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" integrity="sha256-LA89z+k9fjgMKQ/kq4OO2Mrf8VltYml/VES+Rg0fh20=" crossorigin><link rel="preload" as="style" href="https://cdn.jsdelivr.net/npm/@fortawesome/[email protected]/css/all.min.css" integrity="sha256-+N4/V/SbAFiW1MPBCXnfnP9QSN3+Keu+NlB+0ev/YKQ=" crossorigin="anonymous"><link rel="preload" as="style" href="/assets/css/main.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" integrity="sha256-LA89z+k9fjgMKQ/kq4OO2Mrf8VltYml/VES+Rg0fh20=" crossorigin="anonymous"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/[email protected]/css/all.min.css" integrity="sha256-+N4/V/SbAFiW1MPBCXnfnP9QSN3+Keu+NlB+0ev/YKQ=" crossorigin="anonymous"><link rel="stylesheet" href="/assets/css/main.css"><link rel="preload" href="/assets/css/home.css" as="style"><link rel="stylesheet" href="/assets/css/home.css"><link rel="preload" as="script" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/jquery.min.js" integrity="sha256-CSXorXvZcTkaix6Yvo6HppcZGetbYMGWSFlBw8HfCJo=" crossorigin="anonymous"><link rel="preload" as="script" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/umd/popper.min.js" integrity="sha256-fTuUgtT7O2rqoImwjrhDgbXTKUwyxxujIMRIK7TbuNU=" crossorigin> 

1<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/jquery.min.js" integrity="sha256-CSXorXvZcTkaix6Yvo6HppcZGetbYMGWSFlBw8HfCJo=" crossorigin="anonymous"></script>

1 

1<script> window.jQuery || document.write('

1<script src="/assets/lib/jquery-3.4.1.min.js"><\/script>'); </script>

1 

1<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/umd/popper.min.js" integrity="sha256-fTuUgtT7O2rqoImwjrhDgbXTKUwyxxujIMRIK7TbuNU=" crossorigin="anonymous"></script>

1 

1<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/js/bootstrap.min.js" integrity="sha256-5+02zu5UULQkO7w1GIr6vftCgMfFdZcAHeDtFnKZsBs=" crossorigin="anonymous" async></script>

1 

1<script src="/assets/js/dist/commons.js" async></script>

1 

1<script src="/assets/js/dist/timeago.min.js" async></script>

1 

1<script src="/assets/js/dist/tooltip-loader.min.js" async></script>

1<body data-spy="scroll" data-target="#toc"><div id="sidebar" class="d-flex flex-column"> <!-- The Side Bar v2.0 https://github.com/cotes2020/jekyll-theme-chirpy © 2017-2019 Cotes Chung MIT License --><div id="nav-wrapper"><div id="profile-wrapper" class="d-flex flex-column"><div id="avatar" class="d-flex justify-content-center"> <a href="/" alt="avatar"> <img src="https://avatars1.githubusercontent.com/u/16731875?s=460&u=44e8a1dbcf2156c8d92cbcff2342bbe753398256&v=4" alt="avatar"> </a></div><div class="profile-text mt-3"><div id="site-title"> <a href="/">S41F</a></div><div id="site-subtitle" class="font-italic">Offensive Security Engineer | Software Developer.</div></div></div><ul class="nav flex-column"><li class="nav-item d-flex justify-content-center active"> <a href="/" class="nav-link d-flex justify-content-center align-items-center w-100"> <i class="fa-fw fas fa-home ml-3 mr-3 unloaded"></i> <span>HOME</span> </a></li><li class="nav-item d-flex justify-content-center "> <a href="/tabs/categories/" class="nav-link d-flex justify-content-center align-items-center w-100"> <i class="fa-fw fas fa-stream ml-3 mr-3 unloaded"></i> <span>CATEGORIES</span> </a></li><li class="nav-item d-flex justify-content-center "> <a href="/tabs/tags/" class="nav-link d-flex justify-content-center align-items-center w-100"> <i class="fa-fw fas fa-tags ml-3 mr-3 unloaded"></i> <span>TAGS</span> </a></li><li class="nav-item d-flex justify-content-center "> <a href="/tabs/archives/" class="nav-link d-flex justify-content-center align-items-center w-100"> <i class="fa-fw fas fa-archive ml-3 mr-3 unloaded"></i> <span>ARCHIVES</span> </a></li><li class="nav-item d-flex justify-content-center "> <a href="/tabs/about/" class="nav-link d-flex justify-content-center align-items-center w-100"> <i class="fa-fw fas fa-info ml-3 mr-3 unloaded"></i> <span>

1ABOUT</span> </a></li></ul></div><div class="sidebar-bottom d-flex flex-wrap justify-content-around mt-4"> <span id="mode-toggle-wrapper"> <!-- Switch the mode between dark and light. v2.1 https://github.com/cotes2020/jekyll-theme-chirpy © 2020 Cotes Chung MIT License --> <i class="mode-toggle fas fa-sun" light-mode-invisible></i> <i class="mode-toggle fas fa-moon" dark-mode-invisible></i> 

1<script type="text/javascript"> class ModeToggle { static get MODE_KEY() { return "mode"; } static get DARK_MODE() { return "dark"; } static get LIGHT_MODE() { return "light"; } constructor() { if (this.mode != null) { if (this.mode == ModeToggle.DARK_MODE) { if (!this.isSysDarkPrefer) { this.setDark(); } } else { if (this.isSysDarkPrefer) { this.setLight(); } } } var self = this; /* always follow the system prefers */ this.sysDarkPrefers.addListener(function() { if (self.mode != null) { if (self.mode == ModeToggle.DARK_MODE) { if (!self.isSysDarkPrefer) { self.setDark(); } } else { if (self.isSysDarkPrefer) { self.setLight(); } } self.clearMode(); } }); } /* constructor() */ setDark() { $('html').attr(ModeToggle.MODE_KEY, ModeToggle.DARK_MODE); sessionStorage.setItem(ModeToggle.MODE_KEY, ModeToggle.DARK_MODE); } setLight() { $('html').attr(ModeToggle.MODE_KEY, ModeToggle.LIGHT_MODE); sessionStorage.setItem(ModeToggle.MODE_KEY, ModeToggle.LIGHT_MODE); } clearMode() { $('html').removeAttr(ModeToggle.MODE_KEY); sessionStorage.removeItem(ModeToggle.MODE_KEY); } get sysDarkPrefers() { return window.matchMedia("(prefers-color-scheme: dark)"); } get isSysDarkPrefer() { return this.sysDarkPrefers.matches; } get isDarkMode() { return this.mode == ModeToggle.DARK_MODE; } get isLightkMode() { return this.mode == ModeToggle.LIGHT_MODE; } get hasMode() { return this.mode != null; } get mode() { return sessionStorage.getItem(ModeToggle.MODE_KEY); } flipMode() { if (this.hasMode) { if (this.isSysDarkPrefer) { if (this.isLightkMode) { this.clearMode(); } else { this.setLight(); } } else { if (this.isDarkMode) { this.clearMode(); } else { this.setDark(); } } } else { if (this.isSysDarkPrefer) { this.setLight(); } else { this.setDark(); } } } /* flipMode() */ } /* ModeToggle */ let toggle = new ModeToggle(); $(".mode-toggle").click(function() { toggle.flipMode(); }); </script>

1 </span> <span class="icon-border"></span> <a href="https://github.com/saifsalah" target="_blank"> <i class="fab fa-github-alt"></i> </a> <a href="https://twitter.com/6675636b6f6666" target="_blank"> <i class="fab fa-twitter"></i> </a> <a href="javascript:window.open('mailto:' + ['',''].join('@'))"> <i class="fas fa-envelope"></i> </a> <a href="/feed.xml" target="_blank"> <i class="fas fa-rss"></i> </a></div></div><div id="main-wrapper"> <!-- The Top Bar v2.0 https://github.com/cotes2020/jekyll-theme-chirpy © 2017-2019 Cotes Chung MIT License --><div id="topbar-wrapper" class="row justify-content-center topbar-down"><div id="topbar" class="col-11 d-flex h-100 align-items-center justify-content-between"> <span id="breadcrumb"> <span>Posts</span> </span> <i id="sidebar-trigger" class="fas fa-bars fa-fw"></i><div id="topbar-title"> S41F</div><i id="search-trigger" class="fas fa-search fa-fw"></i> <span id="search-wrapper" class="align-items-center"> <i class="fas fa-search fa-fw"></i> <input class="form-control" id="search-input" type="search" placeholder="Search..."> <i class="fa fa-times-circle fa-fw" id="search-cleaner"></i> </span> <span id="search-cancel" >Cancel</span></div></div><div id="main"> <!-- Fixed kramdown code highlight rendering: https://github.com/penibelst/jekyll-compress-html/issues/101 https://github.com/penibelst/jekyll-compress-html/issues/71#issuecomment-188144901 --><div class="row"><div class="col-12 col-lg-11 col-xl-8"><div id="page" class="post pb-5 pl-1 pr-1 pl-sm-2 pr-sm-2 pl-md-4 pr-md-4 mb-md-4"><div id="post-list"><div class="post-preview"><h1> <a href="/posts/breaking-firebase-authorization/">Everyone's a Developer Now - From Zero to Admin on a Firebase App</a></h1><div class="post-content"><p> Intro More and more critical systems are getting built by people who lean on AI to write code they don’t fully understand. That’s the pattern behind this whole writeup. The app I’ll walk through i...</p></div><div class="post-meta text-muted"> <i class="far fa-clock fa-fw"></i> <span class="timeago" data-toggle="tooltip" data-placement="bottom" title="Tue, Sep 1, 2026, 12:00 AM +0300"> Sep 1, 2026 <i class="unloaded">2026-09-01T00:00:00+03:00</i> </span></div></div><div class="post-preview"><h1> <a href="/posts/SeImpersonatePrivilege/">What Happens When You Exploit SeImpersonatePrivilege?</a></h1><div class="post-content"><p> Introduction A while back, someone asked me a question that actually made sense. He wanted to know HOW the SeImpersonatePrivilege exploitation really works. Like, why does having this privilege le...</p></div><div class="post-meta text-muted"> <i class="far fa-clock fa-fw"></i> <span class="timeago" data-toggle="tooltip" data-placement="bottom" title="Fri, Nov 21, 2025, 12:00 AM +0300"> Nov 21, 2025 <i class="unloaded">2025-11-21T00:00:00+03:00</i> </span></div></div><div class="post-preview"><h1> <a href="/posts/PE-FileStructure/">Understanding Portable Executable (PE) File Structure</a></h1><div class="post-content"><p> Introduction If you’ve ever wondered what makes your Windows programs tick, you’re in the right place. In this article, we’ll delve into the world of Portable Executable (PE) files, the backbone o...</p></div><div class="post-meta text-muted"> <i class="far fa-clock fa-fw"></i> <span class="timeago" data-toggle="tooltip" data-placement="bottom" title="Fri, Sep 8, 2023, 12:00 AM +0300"> Sep 8, 2023 <i class="unloaded">2023-09-08T00:00:00+03:00</i> </span></div></div></div><!-- The paginator for post list on HomgPage. v2.1 https://github.com/cotes2020/jekyll-theme-chirpy © 2020 Cotes Chung MIT License --><ul class="pagination mt-4 mb-0 pl-lg-2"><li class="page-item disabled"> <a class="page-link btn-box-shadow" href="#"><i class="fas fa-angle-left"></i></a></li><li class="page-item active"> <a class="page-link btn-box-shadow" href="/">1</a></li><li class="page-item disabled"> <a class="page-link btn-box-shadow" href="#"><i class="fas fa-angle-right"></i></a></li></ul></div></div><!-- The Pannel on right side (Desktop views) v2.0 https://github.com/cotes2020

1/jekyll-theme-chirpy © 2017-2019 Cotes Chung MIT License --><div id="panel-wrapper" class="col-xl-3 pl-2 text-muted topbar-down"><div class="access"><div id="access-tags"><h3 data-toc-skip>Trending Tags</h3><div class="d-flex flex-wrap mt-3 mb-1 mr-3"> <!-- The trending tags list v2.0 https://github.com/cotes2020/jekyll-theme-chirpy © 2019 Cotes Chung MIT Licensed --> <a class="post-tag" href="/tags/windows-executables/">Windows Executables</a> <a class="post-tag" href="/tags/token-impersonation/">Token Impersonation</a> <a class="post-tag" href="/tags/seimpersonateprivilege/">SeImpersonatePrivilege</a> <a class="post-tag" href="/tags/privilege-escalation/">Privilege Escalation</a> <a class="post-tag" href="/tags/pe-file/">PE File</a> <a class="post-tag" href="/tags/named-pipes/">Named Pipes</a> <a class="post-tag" href="/tags/golang/">Golang</a> <a class="post-tag" href="/tags/firestore/">Firestore</a> <a class="post-tag" href="/tags/firebase/">Firebase</a> <a class="post-tag" href="/tags/file-structure/">File Structure</a></div></div></div></div></div><!-- The Footer v2.0 https://github.com/cotes2020/jekyll-theme-chirpy © 2017-2019 Cotes Chung MIT License --><footer class="d-flex w-100 justify-content-center"><div class="d-flex justify-content-between align-items-center"><div class="footer-left"><p class="mb-0"> © 2026 <a href="https://twitter.com/6675636b6f6666">Saif Salah</a>. <span data-toggle="tooltip" data-placement="top" title="Except where otherwise noted, the blog posts on this site are licensed under the Creative Commons Attribution 4.0 International (CC BY 4.0) License by the author.">Some rights reserved.</span></p></div><div class="footer-right"><p class="mb-0"> Powered by <a href="https://jekyllrb.com" target="_blank">Jekyll</a> with theme <a href="https://github.com/cotes2020/jekyll-theme-chirpy/">Chirpy</a>.</p></div></div></footer></div><!-- The Search results v2.0 https://github.com/cotes2020/jekyll-theme-chirpy © 2017-2019 Cotes Chung MIT License --><div id="search-result-wrapper" class="d-flex justify-content-center unloaded"><div class="col-12 col-xl-11 post-content"><div id="search-hints"><h4 class="text-muted">Trending Tags</h4><!-- The trending tags list v2.0 https://github.com/cotes2020/jekyll-theme-chirpy © 2019 Cotes Chung MIT Licensed --> <a class="post-tag" href="/tags/windows-executables/">Windows Executables</a> <a class="post-tag" href="/tags/token-impersonation/">Token Impersonation</a> <a class="post-tag" href="/tags/seimpersonateprivilege/">SeImpersonatePrivilege</a> <a class="post-tag" href="/tags/privilege-escalation/">Privilege Escalation</a> <a class="post-tag" href="/tags/pe-file/">PE File</a> <a class="post-tag" href="/tags/named-pipes/">Named Pipes</a> <a class="post-tag" href="/tags/golang/">Golang</a> <a class="post-tag" href="/tags/firestore/">Firestore</a> <a class="post-tag" href="/tags/firebase/">Firebase</a> <a class="post-tag" href="/tags/file-structure/">File Structure</a></div><div id="search-results" class="d-flex flex-wrap justify-content-center text-muted mt-3"></div></div></div></div><div id="mask"></div><a id="back-to-top" href="#" class="btn btn-lg btn-box-shadow" role="button"> <i class="fas fa-angle-up"></i> </a> <!-- The GA snippet v2.0 https://github.com/cotes2020/jekyll-theme-chirpy © 2017-2019 Cotes Chung MIT License --> 

1<script> (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){ (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o), m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m) })(window,document,'script','https://www.google-analytics.com/analytics.js','ga'); ga('create', '', 'auto'); ga('send', 'pageview'); </script>

1 <!-- Jekyll Simple Search loader v2.0 https://github.com/cotes2020/jekyll-theme-chirpy © 2017-2019 Cotes Chung MIT License --> 

1<script src="https://cdn.jsdelivr.net/npm/[email protected]/dest/simple-jekyll-search.min.js" integrity="sha256-qcLR00zq6pJk4je3MLgAri8Nn+ZumUlXgTKR2H/xCY0=" crossorigin="anonymous"></script>

1 

1<script> SimpleJekyllSearch({ searchInput: document.getElementById('search-input'), resultsContainer: document.getElementById('search-results'), json: '/assets/data/search.json', searchResultTemplate: '<div class="pl-1 pr-1 pl-sm-2 pr-sm-2 pl-lg-4 pr-lg-4 pl-xl-0 pr-xl-0"> <a href="https://saifsalah.github.io{url}">{title}</a><div class="post-meta d-flex flex-column flex-sm-row text-muted mt-1 mb-1"><div class="mr-sm-4"><i class="far fa-folder fa-fw"></i>{categories}</div><div><i class="fa fa-tag fa-fw"></i>{tags}</div></div><p>{snippet}</p></div>', noResultsText: '<p class="mt-5">Oops! No result founds.</p>' }); </script>

1