Write-ups

Altered | HackTheBox

A hard-difficulty Linux box centered on a Laravel password-reset flow brute-forced past rate limiting with spoofed IP headers, then a type-juggling bypass that unlocks SQL …

WIP - Fulcrum | HackTheBox - WIP

Reset | HackTheBox

An easy-difficulty Linux box chaining an insecure password reset into admin access, an LFI that becomes RCE through Apache log poisoning, lateral movement by abusing BSD r-services …

Routing-based SSRF via Host Header

This post talks about how the Host header becomes an SSRF primitive, how front-end routing works, why trusting the Host header breaks the trust boundary between proxy and back-end, …

WIP - XXE Explained - WIP

A full breakdown of XML External Entity (XXE) injection: what it is, the XML internals that make it possible, where the attack surface hides, and a few examples of attack paths. …

Validation | HackTheBox

An easy-difficulty Linux box centered on a blind SQL injection in a registration form's country parameter, chained through sqlmap's FILE privilege abuse into a PHP webshell and …

DarkZero | HackTheBox

A hard-difficulty Windows AD box built around a cross-forest MSSQL trusted link, SeServiceLogonRight abuse to recover SeImpersonatePrivilege, and unconstrained TGT delegation …

Intro to DACL Attacks

My write-up for the skills assessment of HTB Academy's DACL Attacks I module. Starting from a low-priv foothold, we chain a targeted Kerberoast, two separate WriteOwner/GenericAll …

Promoted | WebVerse

A web challenge centered on an AI 'Auto-mod copilot' that runs raw GraphQL queries on behalf of chat users with a privileged service account, allowing anyone to promote themselves …

Peppo | OffSec

A Linux box centered on PostgreSQL. Superuser database access leads to RCE inside a Docker container, ident protocol leaks a username, and docker group membership hands over root …

Extplorer | OffSec

A Linux box built around eXtplorer, a PHP file manager. Default creds get a webshell, leaked credentials pivot to a local user, and disk group membership leads straight to root.

The Roundhouse Society | WebVerse

A web challenge involving Reflected DOM XSS in a museum catalog application, escalated to authenticated credential harvesting via same-origin fetch.

Remote | HackTheBox

An easy Windows box running Umbraco CMS. Creds leak from a world-readable NFS share, an authenticated Umbraco exploit gets a foothold, and a Print Spooler abuse gets SYSTEM.

GroundWorm | HackTheBox

A walkthrough of GroundWorm, a hard-rated DFIR Sherlock on HackTheBox, tracing a simulated APT attack from initial access through ransomware deployment using Splunk and API …

Infostealer Analysis

An investigation into a simple infostealer, following the retired TeleStealer Lab from CyberDefenders, covering static and dynamic malware analysis.

Intro to Malware Analysis

A high-level overview of the steps taken in the MalaCrypt lab from CyberDefenders, covering static and dynamic malware analysis.

Linux Privilege Escalation | TryHackMe

A walk-through of the Linux Privilege Escalation room in the Jr Penetration Tester pathway on TryHackMe, covering eight core privilege escalation techniques.