BBeau Carnes1d ago · 2 min readLearn Real-World Penetration Testing: Hands-On Ethical Hacking Crash CourseUnderstanding how malicious actors infiltrate networks is the first step to building resilient infrastructure. To help developers and aspiring security analysts learn the fundamentals of offensive secfreecodecamp.org
MM1HOct 23 · 7 min readKitsune: AD CS ESC13 to Domain Admin via Backup OperatorsObjective You have been hired to perform an internal pentest against the client's Domain Controller. Your task is to identify all vulnerabilities and (if possible) fully compromise the Domain. CTF Lin1m1h.hashnode.dev
BB1t_Syph0nOct 22 · 2 min readCyberheroes TryHackMe Walkthrough | B1t_Syph0nGoal Enumerate a target web application, observe open ports, and obtain a flag. Execution & Troubleshooting 1. Initial Scanning I attempted to run an nmap scan against the target ip, but all scanned pb1t-syph0n.hashnode.dev
YYogeshwar PeelaOct 17 · 27 min readHackTheBox: Odori WriteupSummary Odori ships as an offline forensics box: the only live services are SSH and Samba, and an anonymously readable backup share just points to a BitLocker-encrypted VMDK handed out with the machinexploitnotes.hashnode.dev
MM1HOct 13 · 12 min readHow I Got My First Official High Severity CVE That Leads to Admin Account HijackingOverview: My security audit of Grav CMS, one of the most popular flat-file content management systems resulted in the responsible disclosure of CVE-2026-92916, with a CVSS v4 score of 8.7 (High). The 1m1h.hashnode.dev
YYogeshwar PeelaOct 12 · 8 min readTryHackMe: PlottedTMS WriteupSummary Plotted is a Linux CTF box hosting a PHP "Traffic Offense Management System" (TOMS) admin panel across two web services (ports 80 and 445). Initial enumeration uncovered decoy files and a leakexploitnotes.hashnode.dev
YYogeshwar PeelaOct 12 · 7 min readTryHackMe: Gallery WriteupSummary Gallery is a Linux box running a "Simple Image Gallery System" PHP application on port 8080. The login form is vulnerable to a classic SQL injection auth bypass, which grants admin access. Theexploitnotes.hashnode.dev
CCiphemic academiaOct 10 · 13 min readThreat Modeling vs. Penetration Testing: The $80 Million Lesson From Capital OneThreat Modeling vs. Penetration Testing: The $80 Million Lesson From Capital One In 2019, an attacker got into Capital One's cloud environment through a misconfigured web application firewall. From thciphemicacademia.hashnode.dev
YYogeshwar PeelaOct 7 · 15 min readTryHackMe - SeaSurfer writeupExecutive Summary The engagement began with a single disclosed virtual host name leaking out of an HTTP response header on the target web server. That one leak unraveled the entire box: it led to a Woexploitnotes.hashnode.dev
YYogeshwar PeelaOct 7 · 9 min readTryHackMe: MD2PDF WriteupSummary MD2PDF is a web app that converts user-submitted Markdown into a downloadable PDF using a server-side rendering engine. The input is not sanitized, so raw HTML is rendered as-is - including taexploitnotes.hashnode.dev
