Introducing the Model Context Protocol
Introducing the Model Context Protocol
AI
ARX
Dreamhack: My-ARX-Cipher
Reversing a custom 3-round ARX block cipher from a binary and inverting each Add-Rotate-XOR round to recover the flag
ActiveMQ
Hack The Box: Broker
Hack The Box Broker walkthrough from an Apache ActiveMQ OpenWire RCE to an nginx sudo privilege escalation
AlaSQL
Dreamhack: web-alasql
Reaching RCE through AlaSQL 0.6.0's browser-facing alaserver by injecting a new Function() sandbox escape into compiled SQL and piping /flag out over netcat
Apache
Cyber Apocalypse CTF 2025: Apache Confusion Attack
Exploiting an Apache handler confusion vulnerability in Cyber Apocalypse CTF 2025
Bytecode
Dreamhack: pyc
Defeating a self-modifying Python bytecode challenge that rewrites its own check function with ctypes before comparing, then reversing the real rotate-and-XOR transform
CRLF
Cyber Apocalypse CTF 2025: Apache Confusion Attack
Exploiting an Apache handler confusion vulnerability in Cyber Apocalypse CTF 2025
CTF
PwnMe 2025 CTF: Hack the Bot 1
PwnMe 2025 CTF writeup covering path traversal to Chromium cookie decryption
Cyber Apocalypse CTF 2025: Apache Confusion Attack
Exploiting an Apache handler confusion vulnerability in Cyber Apocalypse CTF 2025
Dreamhack Invitational 2025 Quals CTF Writeup
Web challenge writeups from the Dreamhack Invitational 2025 Quals
CVE
Hack The Box: Monitored
Hack The Box Monitored walkthrough from SNMP credential leakage through a Nagios XI SQL injection to a sudo service-script privilege escalation
Hack The Box: Lame
Hack The Box Lame walkthrough exploiting the Samba usermap_script command injection (CVE-2007-2447) straight to root
Hack The Box: Keeper
Hack The Box Keeper walkthrough from Request Tracker default credentials to a KeePass memory dump master password recovery
Hack The Box: Broker
Hack The Box Broker walkthrough from an Apache ActiveMQ OpenWire RCE to an nginx sudo privilege escalation
Hack The Box: BoardLight
Hack The Box BoardLight walkthrough from Dolibarr RCE to Enlightenment privilege escalation
Capabilities
Hack The Box: Intentions
Hack The Box Intentions walkthrough from a second-order SQL injection and BCrypt login bypass to an ImageMagick MSL webshell and a capability-based file-read oracle
Chromium
PwnMe 2025 CTF: Hack the Bot 1
PwnMe 2025 CTF writeup covering path traversal to Chromium cookie decryption
Cipher
Dreamhack: My-ARX-Cipher
Reversing a custom 3-round ARX block cipher from a binary and inverting each Add-Rotate-XOR round to recover the flag
Class-Pollution
Dreamhack: pybrid
Turning a recursive merge() into Python class pollution, walking __class__ to plant a cmd attribute on the Principal class and reach a popen-backed RCE
Command-Injection
Hack The Box: Networked
Hack The Box Networked walkthrough from an upload filter bypass to a cron filename command injection and an ifcfg script privilege escalation
Hack The Box: CozyHosting
Hack The Box CozyHosting walkthrough from a Spring Boot Actuator session hijack to a sudo ssh privilege escalation
Hack The Box: Busqueda
Hack The Box Busqueda walkthrough from a Searchor command injection to a sudo script relative-path privilege escalation
Cookie
Cookie Sandwich Attack: Is HttpOnly Really Safe?
Understanding Cookie Sandwich Attack technique for stealing HttpOnly cookies
PwnMe 2025 CTF: Hack the Bot 1
PwnMe 2025 CTF writeup covering path traversal to Chromium cookie decryption
Credentials
Hack The Box: Keeper
Hack The Box Keeper walkthrough from Request Tracker default credentials to a KeePass memory dump master password recovery
Crypto
Dreamhack: My-ARX-Cipher
Reversing a custom 3-round ARX block cipher from a binary and inverting each Add-Rotate-XOR round to recover the flag
Cursor
Introducing the Model Context Protocol
Introducing the Model Context Protocol
DNS
Active Information Gathering Techniques
Techniques for active information gathering
DNS Tunneling Through Deep Packet Inspection
Exfiltrating data over DNS and evading deep packet inspection with dnscat2
DOM-Clobbering
DOM Clobbering: When HTML Overwrites JavaScript
An in-depth exploration of DOM Clobbering attacks
DPAPI
Hack The Box: Access
Hack The Box Access walkthrough from anonymous FTP artifacts to a runas savecred privilege escalation
DPI
DNS Tunneling Through Deep Packet Inspection
Exfiltrating data over DNS and evading deep packet inspection with dnscat2
Deserialization
Dreamhack Invitational 2025 Quals CTF Writeup
Web challenge writeups from the Dreamhack Invitational 2025 Quals
Hack The Box: UpDown
Hack The Box UpDown walkthrough from Phar deserialization to root
Docker
Hack The Box: Busqueda
Hack The Box Busqueda walkthrough from a Searchor command injection to a sudo script relative-path privilege escalation
Dolibarr
Hack The Box: BoardLight
Hack The Box BoardLight walkthrough from Dolibarr RCE to Enlightenment privilege escalation
Dreamhack
Dreamhack: Rednose-Airlines
Chaining a login-error SSTI that leaks Flask config and the JWT signing key, forging an admin token, then abusing a curl-based endpoint with file:// and glob brute-forcing to read the flag within a rate limit
Dreamhack: spring-view
A cookie-controlled Thymeleaf view name turns into template injection, bypassing a Runtime/java/class blacklist with string concatenation to reach Runtime.exec RCE
Dreamhack: node_api
Breaking an Express Redis-log endpoint by passing an array query parameter to skip a GET-only filter, then issuing SET to overwrite a session in the store and log in as admin
Dreamhack: web-alasql
Reaching RCE through AlaSQL 0.6.0's browser-facing alaserver by injecting a new Function() sandbox escape into compiled SQL and piping /flag out over netcat
Dreamhack: pybrid
Turning a recursive merge() into Python class pollution, walking __class__ to plant a cmd attribute on the Principal class and reach a popen-backed RCE
Dreamhack: Insane Python
Abusing a user-controlled Python str.format() template to walk from a bound method's __globals__ into the module's CONFIG dict and leak the flag
Dreamhack: Self-deception
Chaining an HAProxy request-smuggling bypass, a JWT algorithm-confusion forgery, and a JavaScript parseFloat/parseInt balance trick to reach the flag
Dreamhack: pyc
Defeating a self-modifying Python bytecode challenge that rewrites its own check function with ctypes before comparing, then reversing the real rotate-and-XOR transform
Dreamhack: phpythonode
Chaining a Redis command injection through a Node API, an RDB-dump PHP webshell, and a Python SSRF into an internal PHP LFI to run readflag
Dreamhack: My-ARX-Cipher
Reversing a custom 3-round ARX block cipher from a binary and inverting each Add-Rotate-XOR round to recover the flag
Enumeration
Active Information Gathering Techniques
Techniques for active information gathering
Exfiltration
DNS Tunneling Through Deep Packet Inspection
Exfiltrating data over DNS and evading deep packet inspection with dnscat2
Express
Dreamhack: node_api
Breaking an Express Redis-log endpoint by passing an array query parameter to skip a GET-only filter, then issuing SET to overwrite a session in the store and log in as admin
FTP
Hack The Box: Access
Hack The Box Access walkthrough from anonymous FTP artifacts to a runas savecred privilege escalation
Fastjson
Dreamhack Invitational 2025 Quals CTF Writeup
Web challenge writeups from the Dreamhack Invitational 2025 Quals
File-Upload
Hack The Box: Networked
Hack The Box Networked walkthrough from an upload filter bypass to a cron filename command injection and an ifcfg script privilege escalation
Hack The Box: Help
Hack The Box Help walkthrough from a GraphQL credential leak to a HelpDeskZ file upload RCE and a kernel exploit
Filter-Chain
PHP Filter Chain: Beyond Simple LFI
Guide to PHP Filter Chain exploitation technique
Flask
Dreamhack: Rednose-Airlines
Chaining a login-error SSTI that leaks Flask config and the JWT signing key, forging an admin token, then abusing a curl-based endpoint with file:// and glob brute-forcing to read the flag within a rate limit
Format-String
Dreamhack: Insane Python
Abusing a user-controlled Python str.format() template to walk from a bound method's __globals__ into the module's CONFIG dict and leak the flag
Generator
Understanding Python: Iterators, Iterables, and Generators
Python's iteration protocols and their efficient implementation
GitPython
Hack The Box: Editorial
Hack The Box Editorial walkthrough covering SSRF, internal API discovery, leaked credentials, and GitPython privilege escalation
GraphQL
Hack The Box: Help
Hack The Box Help walkthrough from a GraphQL credential leak to a HelpDeskZ file upload RCE and a kernel exploit
HAProxy
Dreamhack: Self-deception
Chaining an HAProxy request-smuggling bypass, a JWT algorithm-confusion forgery, and a JavaScript parseFloat/parseInt balance trick to reach the flag
HPP
HTTP Parameter Pollution
An in-depth exploration of HTTP Parameter Pollution attacks
HTB
Hack The Box: Networked
Hack The Box Networked walkthrough from an upload filter bypass to a cron filename command injection and an ifcfg script privilege escalation
Hack The Box: Monitored
Hack The Box Monitored walkthrough from SNMP credential leakage through a Nagios XI SQL injection to a sudo service-script privilege escalation
Hack The Box: Lame
Hack The Box Lame walkthrough exploiting the Samba usermap_script command injection (CVE-2007-2447) straight to root
Hack The Box: Keeper
Hack The Box Keeper walkthrough from Request Tracker default credentials to a KeePass memory dump master password recovery
Hack The Box: Intentions
Hack The Box Intentions walkthrough from a second-order SQL injection and BCrypt login bypass to an ImageMagick MSL webshell and a capability-based file-read oracle
Hack The Box: Help
Hack The Box Help walkthrough from a GraphQL credential leak to a HelpDeskZ file upload RCE and a kernel exploit
Hack The Box: CozyHosting
Hack The Box CozyHosting walkthrough from a Spring Boot Actuator session hijack to a sudo ssh privilege escalation
Hack The Box: Busqueda
Hack The Box Busqueda walkthrough from a Searchor command injection to a sudo script relative-path privilege escalation
Hack The Box: Broker
Hack The Box Broker walkthrough from an Apache ActiveMQ OpenWire RCE to an nginx sudo privilege escalation
Hack The Box: Access
Hack The Box Access walkthrough from anonymous FTP artifacts to a runas savecred privilege escalation
Hack The Box: Editorial
Hack The Box Editorial walkthrough covering SSRF, internal API discovery, leaked credentials, and GitPython privilege escalation
Hack The Box: BoardLight
Hack The Box BoardLight walkthrough from Dolibarr RCE to Enlightenment privilege escalation
Hack The Box: UpDown
Hack The Box UpDown walkthrough from Phar deserialization to root
HTML
DOM Clobbering: When HTML Overwrites JavaScript
An in-depth exploration of DOM Clobbering attacks
HTTP
HTTP Parameter Pollution
An in-depth exploration of HTTP Parameter Pollution attacks
HTTP-Smuggling
Cyber Apocalypse CTF 2025: Apache Confusion Attack
Exploiting an Apache handler confusion vulnerability in Cyber Apocalypse CTF 2025
Hashcat
A Comprehensive Guide to Password Attacks
Understanding and implementing various password attack techniques for security testing
HttpOnly
Cookie Sandwich Attack: Is HttpOnly Really Safe?
Understanding Cookie Sandwich Attack technique for stealing HttpOnly cookies
Hydra
A Comprehensive Guide to Password Attacks
Understanding and implementing various password attack techniques for security testing
ImageMagick
Hack The Box: Intentions
Hack The Box Intentions walkthrough from a second-order SQL injection and BCrypt login bypass to an ImageMagick MSL webshell and a capability-based file-read oracle
Information-Gathering
Active Information Gathering Techniques
Techniques for active information gathering
Iterable
Understanding Python: Iterators, Iterables, and Generators
Python's iteration protocols and their efficient implementation
Iterator
Understanding Python: Iterators, Iterables, and Generators
Python's iteration protocols and their efficient implementation
JWT
Dreamhack: Rednose-Airlines
Chaining a login-error SSTI that leaks Flask config and the JWT signing key, forging an admin token, then abusing a curl-based endpoint with file:// and glob brute-forcing to read the flag within a rate limit
Dreamhack: Self-deception
Chaining an HAProxy request-smuggling bypass, a JWT algorithm-confusion forgery, and a JavaScript parseFloat/parseInt balance trick to reach the flag
Java
Dreamhack: spring-view
A cookie-controlled Thymeleaf view name turns into template injection, bypassing a Runtime/java/class blacklist with string concatenation to reach Runtime.exec RCE
JavaScript
Prototype Pollution: Poisoning JavaScript's Object Chain
How Prototype Pollution corrupts JavaScript's prototype chain and how to defend against it
DOM Clobbering: When HTML Overwrites JavaScript
An in-depth exploration of DOM Clobbering attacks
KeePass
Hack The Box: Keeper
Hack The Box Keeper walkthrough from Request Tracker default credentials to a KeePass memory dump master password recovery
Kernel-Exploit
Hack The Box: Help
Hack The Box Help walkthrough from a GraphQL credential leak to a HelpDeskZ file upload RCE and a kernel exploit
Kernel-Exploits
Linux Privilege Escalation Techniques
Common Linux privilege escalation techniques for OSCP and CTFs
LFI
PHP Filter Chain: Beyond Simple LFI
Guide to PHP Filter Chain exploitation technique
Dreamhack: phpythonode
Chaining a Redis command injection through a Node API, an RDB-dump PHP webshell, and a Python SSRF into an internal PHP LFI to run readflag
LLM
Introducing the Model Context Protocol
Introducing the Model Context Protocol
Laravel
Hack The Box: Intentions
Hack The Box Intentions walkthrough from a second-order SQL injection and BCrypt login bypass to an ImageMagick MSL webshell and a capability-based file-read oracle
Linux
Linux Privilege Escalation Techniques
Common Linux privilege escalation techniques for OSCP and CTFs
Hack The Box: Networked
Hack The Box Networked walkthrough from an upload filter bypass to a cron filename command injection and an ifcfg script privilege escalation
Hack The Box: Monitored
Hack The Box Monitored walkthrough from SNMP credential leakage through a Nagios XI SQL injection to a sudo service-script privilege escalation
Hack The Box: Lame
Hack The Box Lame walkthrough exploiting the Samba usermap_script command injection (CVE-2007-2447) straight to root
Hack The Box: Keeper
Hack The Box Keeper walkthrough from Request Tracker default credentials to a KeePass memory dump master password recovery
Hack The Box: Intentions
Hack The Box Intentions walkthrough from a second-order SQL injection and BCrypt login bypass to an ImageMagick MSL webshell and a capability-based file-read oracle
Hack The Box: Help
Hack The Box Help walkthrough from a GraphQL credential leak to a HelpDeskZ file upload RCE and a kernel exploit
Hack The Box: CozyHosting
Hack The Box CozyHosting walkthrough from a Spring Boot Actuator session hijack to a sudo ssh privilege escalation
Hack The Box: Busqueda
Hack The Box Busqueda walkthrough from a Searchor command injection to a sudo script relative-path privilege escalation
Hack The Box: Broker
Hack The Box Broker walkthrough from an Apache ActiveMQ OpenWire RCE to an nginx sudo privilege escalation
Hack The Box: Editorial
Hack The Box Editorial walkthrough covering SSRF, internal API discovery, leaked credentials, and GitPython privilege escalation
Hack The Box: BoardLight
Hack The Box BoardLight walkthrough from Dolibarr RCE to Enlightenment privilege escalation
Hack The Box: UpDown
Hack The Box UpDown walkthrough from Phar deserialization to root
MCP
Introducing the Model Context Protocol
Introducing the Model Context Protocol
NTLM
A Comprehensive Guide to Password Attacks
Understanding and implementing various password attack techniques for security testing
Nagios-XI
Hack The Box: Monitored
Hack The Box Monitored walkthrough from SNMP credential leakage through a Nagios XI SQL injection to a sudo service-script privilege escalation
Netcat
Active Information Gathering Techniques
Techniques for active information gathering
Network
DNS Tunneling Through Deep Packet Inspection
Exfiltrating data over DNS and evading deep packet inspection with dnscat2
Nginx
PwnMe 2025 CTF: Hack the Bot 1
PwnMe 2025 CTF writeup covering path traversal to Chromium cookie decryption
Hack The Box: Broker
Hack The Box Broker walkthrough from an Apache ActiveMQ OpenWire RCE to an nginx sudo privilege escalation
Nmap
Active Information Gathering Techniques
Techniques for active information gathering
Node
Dreamhack: Self-deception
Chaining an HAProxy request-smuggling bypass, a JWT algorithm-confusion forgery, and a JavaScript parseFloat/parseInt balance trick to reach the flag
Dreamhack: phpythonode
Chaining a Redis command injection through a Node API, an RDB-dump PHP webshell, and a Python SSRF into an internal PHP LFI to run readflag
Node.js
HTTP Parameter Pollution
An in-depth exploration of HTTP Parameter Pollution attacks
NodeJS
Prototype Pollution: Poisoning JavaScript's Object Chain
How Prototype Pollution corrupts JavaScript's prototype chain and how to defend against it
Dreamhack: node_api
Breaking an Express Redis-log endpoint by passing an array query parameter to skip a GET-only filter, then issuing SET to overwrite a session in the store and log in as admin
Dreamhack: web-alasql
Reaching RCE through AlaSQL 0.6.0's browser-facing alaserver by injecting a new Function() sandbox escape into compiled SQL and piping /flag out over netcat
OSCP
Linux Privilege Escalation Techniques
Common Linux privilege escalation techniques for OSCP and CTFs
DNS Tunneling Through Deep Packet Inspection
Exfiltrating data over DNS and evading deep packet inspection with dnscat2
PHP
PHP Filter Chain: Beyond Simple LFI
Guide to PHP Filter Chain exploitation technique
Hack The Box: Networked
Hack The Box Networked walkthrough from an upload filter bypass to a cron filename command injection and an ifcfg script privilege escalation
Dreamhack: phpythonode
Chaining a Redis command injection through a Node API, an RDB-dump PHP webshell, and a Python SSRF into an internal PHP LFI to run readflag
Dreamhack Invitational 2025 Quals CTF Writeup
Web challenge writeups from the Dreamhack Invitational 2025 Quals
Package-Manager
UV: The Fast Rust-based Python Package Manager
A practical guide to uv, the fast Rust-based Python package manager
Pass-the-Hash
A Comprehensive Guide to Password Attacks
Understanding and implementing various password attack techniques for security testing
Passwords
A Comprehensive Guide to Password Attacks
Understanding and implementing various password attack techniques for security testing
Path-Traversal
PwnMe 2025 CTF: Hack the Bot 1
PwnMe 2025 CTF writeup covering path traversal to Chromium cookie decryption
Dreamhack Invitational 2025 Quals CTF Writeup
Web challenge writeups from the Dreamhack Invitational 2025 Quals
Phar
Hack The Box: UpDown
Hack The Box UpDown walkthrough from Phar deserialization to root
PostgreSQL
Hack The Box: CozyHosting
Hack The Box CozyHosting walkthrough from a Spring Boot Actuator session hijack to a sudo ssh privilege escalation
Privilege-Escalation
Linux Privilege Escalation Techniques
Common Linux privilege escalation techniques for OSCP and CTFs
Hack The Box: Networked
Hack The Box Networked walkthrough from an upload filter bypass to a cron filename command injection and an ifcfg script privilege escalation
Hack The Box: Monitored
Hack The Box Monitored walkthrough from SNMP credential leakage through a Nagios XI SQL injection to a sudo service-script privilege escalation
Hack The Box: Intentions
Hack The Box Intentions walkthrough from a second-order SQL injection and BCrypt login bypass to an ImageMagick MSL webshell and a capability-based file-read oracle
Hack The Box: Help
Hack The Box Help walkthrough from a GraphQL credential leak to a HelpDeskZ file upload RCE and a kernel exploit
Hack The Box: CozyHosting
Hack The Box CozyHosting walkthrough from a Spring Boot Actuator session hijack to a sudo ssh privilege escalation
Hack The Box: Busqueda
Hack The Box Busqueda walkthrough from a Searchor command injection to a sudo script relative-path privilege escalation
Hack The Box: Broker
Hack The Box Broker walkthrough from an Apache ActiveMQ OpenWire RCE to an nginx sudo privilege escalation
Hack The Box: Access
Hack The Box Access walkthrough from anonymous FTP artifacts to a runas savecred privilege escalation
Hack The Box: Editorial
Hack The Box Editorial walkthrough covering SSRF, internal API discovery, leaked credentials, and GitPython privilege escalation
Hack The Box: BoardLight
Hack The Box BoardLight walkthrough from Dolibarr RCE to Enlightenment privilege escalation
Hack The Box: UpDown
Hack The Box UpDown walkthrough from Phar deserialization to root
Programming
UV: The Fast Rust-based Python Package Manager
A practical guide to uv, the fast Rust-based Python package manager
Understanding Python: Iterators, Iterables, and Generators
Python's iteration protocols and their efficient implementation
Protocol
Introducing the Model Context Protocol
Introducing the Model Context Protocol
Prototype-Pollution
Prototype Pollution: Poisoning JavaScript's Object Chain
How Prototype Pollution corrupts JavaScript's prototype chain and how to defend against it
Puppeteer
PwnMe 2025 CTF: Hack the Bot 1
PwnMe 2025 CTF writeup covering path traversal to Chromium cookie decryption
Python
UV: The Fast Rust-based Python Package Manager
A practical guide to uv, the fast Rust-based Python package manager
Understanding Python: Iterators, Iterables, and Generators
Python's iteration protocols and their efficient implementation
Dreamhack: pybrid
Turning a recursive merge() into Python class pollution, walking __class__ to plant a cmd attribute on the Principal class and reach a popen-backed RCE
Dreamhack: Insane Python
Abusing a user-controlled Python str.format() template to walk from a bound method's __globals__ into the module's CONFIG dict and leak the flag
Hack The Box: Busqueda
Hack The Box Busqueda walkthrough from a Searchor command injection to a sudo script relative-path privilege escalation
Dreamhack: pyc
Defeating a self-modifying Python bytecode challenge that rewrites its own check function with ctypes before comparing, then reversing the real rotate-and-XOR transform
RCE
PHP Filter Chain: Beyond Simple LFI
Guide to PHP Filter Chain exploitation technique
Dreamhack: web-alasql
Reaching RCE through AlaSQL 0.6.0's browser-facing alaserver by injecting a new Function() sandbox escape into compiled SQL and piping /flag out over netcat
Dreamhack: pybrid
Turning a recursive merge() into Python class pollution, walking __class__ to plant a cmd attribute on the Principal class and reach a popen-backed RCE
Hack The Box: Lame
Hack The Box Lame walkthrough exploiting the Samba usermap_script command injection (CVE-2007-2447) straight to root
Hack The Box: Help
Hack The Box Help walkthrough from a GraphQL credential leak to a HelpDeskZ file upload RCE and a kernel exploit
Hack The Box: Broker
Hack The Box Broker walkthrough from an Apache ActiveMQ OpenWire RCE to an nginx sudo privilege escalation
Hack The Box: BoardLight
Hack The Box BoardLight walkthrough from Dolibarr RCE to Enlightenment privilege escalation
Dreamhack Invitational 2025 Quals CTF Writeup
Web challenge writeups from the Dreamhack Invitational 2025 Quals
Hack The Box: UpDown
Hack The Box UpDown walkthrough from Phar deserialization to root
RFC6265
Cookie Sandwich Attack: Is HttpOnly Really Safe?
Understanding Cookie Sandwich Attack technique for stealing HttpOnly cookies
Redis
Dreamhack: node_api
Breaking an Express Redis-log endpoint by passing an array query parameter to skip a GET-only filter, then issuing SET to overwrite a session in the store and log in as admin
Dreamhack: phpythonode
Chaining a Redis command injection through a Node API, an RDB-dump PHP webshell, and a Python SSRF into an internal PHP LFI to run readflag
Request-Smuggling
Dreamhack: Self-deception
Chaining an HAProxy request-smuggling bypass, a JWT algorithm-confusion forgery, and a JavaScript parseFloat/parseInt balance trick to reach the flag
Request-Tracker
Hack The Box: Keeper
Hack The Box Keeper walkthrough from Request Tracker default credentials to a KeePass memory dump master password recovery
Responder
A Comprehensive Guide to Password Attacks
Understanding and implementing various password attack techniques for security testing
Reversing
Dreamhack: pyc
Defeating a self-modifying Python bytecode challenge that rewrites its own check function with ctypes before comparing, then reversing the real rotate-and-XOR transform
Dreamhack: My-ARX-Cipher
Reversing a custom 3-round ARX block cipher from a binary and inverting each Add-Rotate-XOR round to recover the flag
Rust
UV: The Fast Rust-based Python Package Manager
A practical guide to uv, the fast Rust-based Python package manager
SMB
Active Information Gathering Techniques
Techniques for active information gathering
Hack The Box: Lame
Hack The Box Lame walkthrough exploiting the Samba usermap_script command injection (CVE-2007-2447) straight to root
SMTP
Active Information Gathering Techniques
Techniques for active information gathering
SNMP
Active Information Gathering Techniques
Techniques for active information gathering
Hack The Box: Monitored
Hack The Box Monitored walkthrough from SNMP credential leakage through a Nagios XI SQL injection to a sudo service-script privilege escalation
SQL-Injection
HTTP Parameter Pollution
An in-depth exploration of HTTP Parameter Pollution attacks
Hack The Box: Monitored
Hack The Box Monitored walkthrough from SNMP credential leakage through a Nagios XI SQL injection to a sudo service-script privilege escalation
Hack The Box: Intentions
Hack The Box Intentions walkthrough from a second-order SQL injection and BCrypt login bypass to an ImageMagick MSL webshell and a capability-based file-read oracle
SSRF
Cyber Apocalypse CTF 2025: Apache Confusion Attack
Exploiting an Apache handler confusion vulnerability in Cyber Apocalypse CTF 2025
Dreamhack: Rednose-Airlines
Chaining a login-error SSTI that leaks Flask config and the JWT signing key, forging an admin token, then abusing a curl-based endpoint with file:// and glob brute-forcing to read the flag within a rate limit
Dreamhack: phpythonode
Chaining a Redis command injection through a Node API, an RDB-dump PHP webshell, and a Python SSRF into an internal PHP LFI to run readflag
Hack The Box: Editorial
Hack The Box Editorial walkthrough covering SSRF, internal API discovery, leaked credentials, and GitPython privilege escalation
SSTI
Dreamhack: Rednose-Airlines
Chaining a login-error SSTI that leaks Flask config and the JWT signing key, forging an admin token, then abusing a curl-based endpoint with file:// and glob brute-forcing to read the flag within a rate limit
Dreamhack: spring-view
A cookie-controlled Thymeleaf view name turns into template injection, bypassing a Runtime/java/class blacklist with string concatenation to reach Runtime.exec RCE
Dreamhack: Insane Python
Abusing a user-controlled Python str.format() template to walk from a bound method's __globals__ into the module's CONFIG dict and leak the flag
SUID
Linux Privilege Escalation Techniques
Common Linux privilege escalation techniques for OSCP and CTFs
Samba
Hack The Box: Lame
Hack The Box Lame walkthrough exploiting the Samba usermap_script command injection (CVE-2007-2447) straight to root
Security
Prototype Pollution: Poisoning JavaScript's Object Chain
How Prototype Pollution corrupts JavaScript's prototype chain and how to defend against it
Cookie Sandwich Attack: Is HttpOnly Really Safe?
Understanding Cookie Sandwich Attack technique for stealing HttpOnly cookies
PwnMe 2025 CTF: Hack the Bot 1
PwnMe 2025 CTF writeup covering path traversal to Chromium cookie decryption
Cyber Apocalypse CTF 2025: Apache Confusion Attack
Exploiting an Apache handler confusion vulnerability in Cyber Apocalypse CTF 2025
A Comprehensive Guide to Password Attacks
Understanding and implementing various password attack techniques for security testing
Linux Privilege Escalation Techniques
Common Linux privilege escalation techniques for OSCP and CTFs
Active Information Gathering Techniques
Techniques for active information gathering
DNS Tunneling Through Deep Packet Inspection
Exfiltrating data over DNS and evading deep packet inspection with dnscat2
PHP Filter Chain: Beyond Simple LFI
Guide to PHP Filter Chain exploitation technique
DOM Clobbering: When HTML Overwrites JavaScript
An in-depth exploration of DOM Clobbering attacks
HTTP Parameter Pollution
An in-depth exploration of HTTP Parameter Pollution attacks
Dreamhack: Rednose-Airlines
Chaining a login-error SSTI that leaks Flask config and the JWT signing key, forging an admin token, then abusing a curl-based endpoint with file:// and glob brute-forcing to read the flag within a rate limit
Dreamhack: spring-view
A cookie-controlled Thymeleaf view name turns into template injection, bypassing a Runtime/java/class blacklist with string concatenation to reach Runtime.exec RCE
Dreamhack: node_api
Breaking an Express Redis-log endpoint by passing an array query parameter to skip a GET-only filter, then issuing SET to overwrite a session in the store and log in as admin
Dreamhack: web-alasql
Reaching RCE through AlaSQL 0.6.0's browser-facing alaserver by injecting a new Function() sandbox escape into compiled SQL and piping /flag out over netcat
Dreamhack: pybrid
Turning a recursive merge() into Python class pollution, walking __class__ to plant a cmd attribute on the Principal class and reach a popen-backed RCE
Dreamhack: Insane Python
Abusing a user-controlled Python str.format() template to walk from a bound method's __globals__ into the module's CONFIG dict and leak the flag
Hack The Box: Networked
Hack The Box Networked walkthrough from an upload filter bypass to a cron filename command injection and an ifcfg script privilege escalation
Hack The Box: Monitored
Hack The Box Monitored walkthrough from SNMP credential leakage through a Nagios XI SQL injection to a sudo service-script privilege escalation
Hack The Box: Lame
Hack The Box Lame walkthrough exploiting the Samba usermap_script command injection (CVE-2007-2447) straight to root
Hack The Box: Keeper
Hack The Box Keeper walkthrough from Request Tracker default credentials to a KeePass memory dump master password recovery
Hack The Box: Intentions
Hack The Box Intentions walkthrough from a second-order SQL injection and BCrypt login bypass to an ImageMagick MSL webshell and a capability-based file-read oracle
Hack The Box: Help
Hack The Box Help walkthrough from a GraphQL credential leak to a HelpDeskZ file upload RCE and a kernel exploit
Hack The Box: CozyHosting
Hack The Box CozyHosting walkthrough from a Spring Boot Actuator session hijack to a sudo ssh privilege escalation
Hack The Box: Busqueda
Hack The Box Busqueda walkthrough from a Searchor command injection to a sudo script relative-path privilege escalation
Hack The Box: Broker
Hack The Box Broker walkthrough from an Apache ActiveMQ OpenWire RCE to an nginx sudo privilege escalation
Hack The Box: Access
Hack The Box Access walkthrough from anonymous FTP artifacts to a runas savecred privilege escalation
Dreamhack: Self-deception
Chaining an HAProxy request-smuggling bypass, a JWT algorithm-confusion forgery, and a JavaScript parseFloat/parseInt balance trick to reach the flag
Dreamhack: pyc
Defeating a self-modifying Python bytecode challenge that rewrites its own check function with ctypes before comparing, then reversing the real rotate-and-XOR transform
Dreamhack: phpythonode
Chaining a Redis command injection through a Node API, an RDB-dump PHP webshell, and a Python SSRF into an internal PHP LFI to run readflag
Dreamhack: My-ARX-Cipher
Reversing a custom 3-round ARX block cipher from a binary and inverting each Add-Rotate-XOR round to recover the flag
Hack The Box: Editorial
Hack The Box Editorial walkthrough covering SSRF, internal API discovery, leaked credentials, and GitPython privilege escalation
Hack The Box: BoardLight
Hack The Box BoardLight walkthrough from Dolibarr RCE to Enlightenment privilege escalation
Dreamhack Invitational 2025 Quals CTF Writeup
Web challenge writeups from the Dreamhack Invitational 2025 Quals
Hack The Box: UpDown
Hack The Box UpDown walkthrough from Phar deserialization to root
Session
Dreamhack: node_api
Breaking an Express Redis-log endpoint by passing an array query parameter to skip a GET-only filter, then issuing SET to overwrite a session in the store and log in as admin
Spring
Dreamhack: spring-view
A cookie-controlled Thymeleaf view name turns into template injection, bypassing a Runtime/java/class blacklist with string concatenation to reach Runtime.exec RCE
Dreamhack Invitational 2025 Quals CTF Writeup
Web challenge writeups from the Dreamhack Invitational 2025 Quals
Spring-Boot
Hack The Box: CozyHosting
Hack The Box CozyHosting walkthrough from a Spring Boot Actuator session hijack to a sudo ssh privilege escalation
Sudo
Linux Privilege Escalation Techniques
Common Linux privilege escalation techniques for OSCP and CTFs
Telnet
Hack The Box: Access
Hack The Box Access walkthrough from anonymous FTP artifacts to a runas savecred privilege escalation
Thymeleaf
Dreamhack: spring-view
A cookie-controlled Thymeleaf view name turns into template injection, bypassing a Runtime/java/class blacklist with string concatenation to reach Runtime.exec RCE
Tunneling
DNS Tunneling Through Deep Packet Inspection
Exfiltrating data over DNS and evading deep packet inspection with dnscat2
UV
UV: The Fast Rust-based Python Package Manager
A practical guide to uv, the fast Rust-based Python package manager
Web
Prototype Pollution: Poisoning JavaScript's Object Chain
How Prototype Pollution corrupts JavaScript's prototype chain and how to defend against it
Cookie Sandwich Attack: Is HttpOnly Really Safe?
Understanding Cookie Sandwich Attack technique for stealing HttpOnly cookies
PwnMe 2025 CTF: Hack the Bot 1
PwnMe 2025 CTF writeup covering path traversal to Chromium cookie decryption
Cyber Apocalypse CTF 2025: Apache Confusion Attack
Exploiting an Apache handler confusion vulnerability in Cyber Apocalypse CTF 2025
PHP Filter Chain: Beyond Simple LFI
Guide to PHP Filter Chain exploitation technique
DOM Clobbering: When HTML Overwrites JavaScript
An in-depth exploration of DOM Clobbering attacks
HTTP Parameter Pollution
An in-depth exploration of HTTP Parameter Pollution attacks
Dreamhack: Rednose-Airlines
Chaining a login-error SSTI that leaks Flask config and the JWT signing key, forging an admin token, then abusing a curl-based endpoint with file:// and glob brute-forcing to read the flag within a rate limit
Dreamhack: spring-view
A cookie-controlled Thymeleaf view name turns into template injection, bypassing a Runtime/java/class blacklist with string concatenation to reach Runtime.exec RCE
Dreamhack: node_api
Breaking an Express Redis-log endpoint by passing an array query parameter to skip a GET-only filter, then issuing SET to overwrite a session in the store and log in as admin
Dreamhack: web-alasql
Reaching RCE through AlaSQL 0.6.0's browser-facing alaserver by injecting a new Function() sandbox escape into compiled SQL and piping /flag out over netcat
Dreamhack: pybrid
Turning a recursive merge() into Python class pollution, walking __class__ to plant a cmd attribute on the Principal class and reach a popen-backed RCE
Dreamhack: Insane Python
Abusing a user-controlled Python str.format() template to walk from a bound method's __globals__ into the module's CONFIG dict and leak the flag
Hack The Box: Networked
Hack The Box Networked walkthrough from an upload filter bypass to a cron filename command injection and an ifcfg script privilege escalation
Hack The Box: Monitored
Hack The Box Monitored walkthrough from SNMP credential leakage through a Nagios XI SQL injection to a sudo service-script privilege escalation
Hack The Box: Keeper
Hack The Box Keeper walkthrough from Request Tracker default credentials to a KeePass memory dump master password recovery
Hack The Box: Intentions
Hack The Box Intentions walkthrough from a second-order SQL injection and BCrypt login bypass to an ImageMagick MSL webshell and a capability-based file-read oracle
Hack The Box: Help
Hack The Box Help walkthrough from a GraphQL credential leak to a HelpDeskZ file upload RCE and a kernel exploit
Hack The Box: CozyHosting
Hack The Box CozyHosting walkthrough from a Spring Boot Actuator session hijack to a sudo ssh privilege escalation
Hack The Box: Busqueda
Hack The Box Busqueda walkthrough from a Searchor command injection to a sudo script relative-path privilege escalation
Dreamhack: Self-deception
Chaining an HAProxy request-smuggling bypass, a JWT algorithm-confusion forgery, and a JavaScript parseFloat/parseInt balance trick to reach the flag
Dreamhack: phpythonode
Chaining a Redis command injection through a Node API, an RDB-dump PHP webshell, and a Python SSRF into an internal PHP LFI to run readflag
Hack The Box: Editorial
Hack The Box Editorial walkthrough covering SSRF, internal API discovery, leaked credentials, and GitPython privilege escalation
Hack The Box: BoardLight
Hack The Box BoardLight walkthrough from Dolibarr RCE to Enlightenment privilege escalation
Dreamhack Invitational 2025 Quals CTF Writeup
Web challenge writeups from the Dreamhack Invitational 2025 Quals
Hack The Box: UpDown
Hack The Box UpDown walkthrough from Phar deserialization to root
Windows
Hack The Box: Access
Hack The Box Access walkthrough from anonymous FTP artifacts to a runas savecred privilege escalation
XSS
DOM Clobbering: When HTML Overwrites JavaScript
An in-depth exploration of DOM Clobbering attacks