Blog & Writeups
Web exploitation notes and Hack The Box writeups. Filter by category or search.
-
HTB Writeups
HTB Starting Point: Vaccine
Anonymous FTP hands over a password-protected backup. Crack the zip, crack the admin hash it hides, then ride a PostgreSQL injection to a shell and a sudo vi entry to root.
#linux#ftp#sqli#postgresql#sudo#starting-point -
HTB Writeups
HTB Starting Point: Three
A band's website is served straight out of a writable S3 bucket. Upload a PHP shell to the bucket, request it over HTTP, and you have code execution.
#linux#web#aws#s3#rce -
HTB Writeups
HTB Oopsie
A guest login leaks an admin access ID, two tampered cookies unlock a file upload, and a PHP shell gets me in. Then a SUID binary that calls cat without a path hands over root.
#linux#web#idor#cookies#file-upload#suid#path-hijack#starting-point -
HTB Writeups
HTB Starting Point: Archetype
An anonymous SMB share leaks a database connection string, those creds open MSSQL as sysadmin, and xp_cmdshell turns that into a shell. Then a forgotten PowerShell history file hands over the administrator password.
#windows#smb#mssql#xp_cmdshell#powershell-history#psexec#starting-point -
AI Security
Three AI Security Certs, and Why I Bothered
I sat the Cranium AI Security, AI Red Team, and AI Security Professional certs back to back. Not for the badges, but because I'm building a tool that attacks the exact thing they defend.
#ai-security#red-team#llm#prompt-injection#cranium -
HTB Writeups
HTB Sequel
A passwordless MariaDB on 3306, an SSL handshake that fights a modern client, and reading creds straight out of the tables.
#mysql#mariadb#databases#starting-point -
HTB Writeups
HTB Responder
File inclusion coerces a Windows host into leaking its NTLMv2 hash. Crack it with John, log in over WinRM. Plus the hash-formatting and Ruby gem battles that nearly ended me.
#windows#responder#ntlm#winrm#john#starting-point -
HTB Writeups
HTB Crocodile
Anonymous FTP leaks two credential lists, gobuster finds the login page. The short solve, and the hour of VPN and browser pain around it.
#ftp#gobuster#web#starting-point -
Web Exploitation
Completing PortSwigger's Server-Side Vulnerabilities Path (Apprentice)
I finished all 52 steps of PortSwigger's Apprentice 'Server-side vulnerabilities' path with Burp. Here's what it covers and what actually stuck.
#portswigger#burp#web-security-academy -
Web Exploitation
SQL Injection: UNION-based Data Extraction
Using UNION SELECT to pull data out of other tables once you know the column count and a text-compatible column.
#sqli#databases#union -
HTB Writeups
HTB Writeup Template (retired boxes)
A skeleton I copy for each retired Hack The Box machine: recon, enumeration, foothold, privesc, takeaways.
#linux#web#privesc
No writeups match. Try a different search or category.