~/authors/javelin
Every KSAL blog post and writeup currently attributed to javelin, collected in one place.
Engineering
How JWT algorithm confusion works, why switching RS256 to HS256 lets an attacker sign their own tokens with a public key, and how to shut it down in your own code.
Community
A note to Albanians in Kosovo, Albania, and abroad: if you want to learn, contribute, compete, or simply be around the team, there is room for you here.
Announcements
An introduction to the new KSAL site, what each section is for, how the team will manage posts, and how members can contribute to it over time.
CTF
A look at how KSAL organizes before, during, and after a CTF — from category assignments to writeup handoffs and what we have learned about running it well.
THJCC CTF 2026
A KSAL event writeup for THJCC CTF 2026 that keeps the full challenge archive on-site while preserving two detailed forensic and steganography solves.
BSides Prishtina 2025
A JWT authentication challenge where switching the algorithm from RS256 to HS256 and signing with the server's own public key grants unrestricted admin access.