Posts by Year

THM Wreath Pt.1 — Webmin RCE, Pivoting and a Relayed SYSTEM Shell

11 minute read

HTB Cicada — Anonymous Share Leak, Guest RID-Brute & Backup Operators to Domain Admin

9 minute read

Certighost: How CVE-2026-54121 Turns a Domain User Into a Domain Controller

9 minute read

VulnBank Series #2 — BOLA, Mass Assignment, Broken Transaction Logic & Weak Password Reset

10 minute read

VulnBank Series #1 — Recon, SQLi Auth Bypass & JWT Forgery

9 minute read

Attacking & Defending LSASS — Credential Dumping on Windows Server 2025

9 minute read

HTB TombWatcher — WriteSPN, gMSA Abuse, AD Recycle Bin & ESC15 to Domain Admin

5 minute read

HTB Orion — CraftCMS RCE, MySQL Credential Leak & Telnetd Auth Bypass

4 minute read

HTB FireFlow — Langflow RCE, JWT None Attack & Kubernetes Pod Escape

6 minute read

HTB Voleur — NTLM Disabled, Excel Blueprint, DPAPI & WSL NTDS Backup

7 minute read

HTB Administrator — ACL Chain Abuse, Password Safe & DCSync

5 minute read

HTB DevArea — CXF XXE, Hoverfly RCE & SysWatch Symlink Chain to Root

7 minute read

HTB WingData — Lua Injection RCE, Hash Cracking & Tar Symlink to Root

5 minute read

HTB Silentium — Flowise RCE, Docker Escape & Gogs Symlink to Root

7 minute read

HTB Fluffy — CVE-2025-24071, Shadow Credentials & ESC16 via AD CS

6 minute read

File Magic Bytes — Why You Can Never Trust a File Extension

8 minute read

Hiding In PL41N S1GHT

HTB Sauna — AS-REP Roasting, AutoLogon Credentials & DCSync

5 minute read

HTB Sauna

THM Enterprise — Commit History, Kerberoasting & Unquoted Service Path to SYSTEM

9 minute read

THM Enterprise

DNS Exfiltration — Stealing Data Through the One Protocol Nobody Blocks

7 minute read

I want to talk about one of my favourite “wait, that actually works?” attacks. Not favourite because it’s complex(quite the contrary really), favourite becau...

HTB Forest — AS-REP Roasting, BloodHound & DCSync via Exchange Permissions

5 minute read

HTB Forest

THM VulnNet: Roasted — AS-REP Roasting, Kerberoasting & SYSVOL Secrets

5 minute read

THM VulnNet: Roasted

THM ValenFind — LFI, Hardcoded Secrets & A Broken Heart(ed Database)

4 minute read

THM ValenFind

HTB Active — My First Real Active Directory Box

3 minute read

Difficulty: Easy OS: Windows IP: 10.129.34.50 Status: Retired

Hello World — Who is 0x5h4q?

less than 1 minute read

n0 pl4c3 l1k3 127.0.0.1