Case files

Foundations Active Directory engagement: guest SMB enabled RID brute and username=password spray; Kerberoast cracked file_svc; backup share hashes Pass-the-Hash’d as FileServer$ via PsExec to SYSTEM.

Windows · Active Directory · Kerberos · Pass-the-Hash

Foundations Linux engagement: anonymous FTP leaked usernames and a weak-password hint; Hydra recovered jake’s SSH secret; NOPASSWD less spawned a root shell via GTFOBins.

Linux · FTP · SSH · Privilege Escalation

Linux host with anonymous FTP leaking a task note and password candidates; SSH spray as lin succeeded; misconfigured sudo for /bin/tar yielded root via GTFOBins checkpoint-action.

Linux · FTP · SSH · Privilege Escalation

Foundations Linux engagement: anonymous FTP exposed a GPG private key and encrypted shadow backup; cracked passphrase and root hash yielded direct SSH as root.

Linux · FTP · GPG · Password Cracking

Foundations Linux engagement: CVE-2023-39141 on Aria2 disclosed Tomcat credentials; WAR deploy yielded tomcat; sudo ansible-playbook wildcards pivoted to wilbur; internal gallery upload and TTY pushback completed root.

Linux · Path Traversal · Tomcat · Privilege Escalation

Foundations web engagement: mapped unlimited login attempts to Identification and Authentication Failures and cleartext credentials to Cryptographic Failures, then used an IDOR on sequential user objects to locate and revert malicious changes.

OWASP · IDOR · Authentication · Cryptography

Foundations network engagement: host answered DNS only for givemetheflag.com; dig/nslookup against the target returned a TXT record containing the secret.

DNS · Network Enumeration · Information Disclosure

Foundations Linux engagement: island path enumeration and Base58 decoding unlocked FTP; steghide and zip contents yielded slade’s SSH password; sudo pkexec completed root.

Linux · FTP · Stego · Privilege Escalation

Foundations governance engagement: mapped Confidentiality, Integrity, and Availability to control objectives and privilege design so architecture decisions stay balanced under real threats.

CIA Triad · Governance · Access Control

Foundations governance engagement: drilled Confidentiality, Integrity, and Availability as a balanced security mindset; completed the interactive exercise recovering THM{CIA_IS_ABOUT_BALANCE}.

CIA Triad · Security Mindset · Governance

Foundations web engagement: CyberHeroes login validated entirely in JavaScript; username and ReverseString password were recoverable from page source.

Web · Client-Side Auth · JavaScript

Foundations Linux engagement: castle CMS on port 85 accepted a PHP upload after allowlisting; database and env secrets pivoted toad→mario; rewriting /etc/hosts hijacked a root curl of counter.sh for a reverse shell.

Linux · CMS · Web · Privilege Escalation

Foundations Linux engagement: unauthenticated CMS Made Simple SQLi dumped and cracked mitch’s password; SSH on port 2222 yielded a shell; NOPASSWD vim completed root.

Linux · CMS · SQL Injection · Privilege Escalation

Foundations web engagement: account UI loaded /api/v1/customer?id= without ownership checks; swapping ids disclosed adam84 and j@fakemail.thm plus encoded/hashed ID patterns.

Web · IDOR · API · Access Control

Foundations web engagement: synthesized the full client request path — DNS resolution, HTTP to the origin, HTML/JS/CSS rendering — plus load balancers, CDN, databases, WAF, and virtual hosts; ordered the stack to recover the engagement artifact.

DNS · HTTP · Web Architecture · WAF

Foundations Linux engagement: CV upload accepted shell.pdf.php; webshell as www-data; .bash_history and cron.d/persistence showed a relative pkill — planting ~/bin/pkill caught the next root cron for a reverse shell.

Linux · File Upload · Webshell · Privilege Escalation

Foundations reversing engagement: deliberately broken ELF EI_DATA prevented execution; patching MSB to LSB allowed radare2 analysis that recovered the hardcoded password string.

Reverse Engineering · ELF · Static Analysis

Foundations crypto/stego engagement: multi-encoding decode chain, spectrogram plaintext, image stego, and nested archive inspection recovered hidden strings.

Cryptography · Steganography · Encoding · OSINT

Foundations Windows engagement: MS17-010 EternalBlue via Metasploit yielded SYSTEM; hashdump recovered Jon’s NTLM; rockyou cracked alqfna22 and located admin artifacts.

Windows · SMB · Metasploit · Password Cracking

Foundations Windows engagement: unauthenticated FreeSWITCH mod_event_socket on 8021 (EDB-47799) executed commands as Nekrotic; OpenClinic GA LPE (EDB-50448) replaced mysqld.exe for a SYSTEM shell after reboot.

Windows · VoIP · FreeSWITCH · Privilege Escalation

Foundations Linux engagement: anonymous FTP yielded a base64-encoded personal password for Weston; sudo bees impersonated Cage; a world-writable cron quotes file delivered a reverse shell and root mailbox credentials.

FTP · Privilege Escalation · Cron · Credential Recovery

Anonymous FTP mapped into Apache /files/ftp/, enabling a PHP reverse shell as www-data. An incident PCAP leaked lennie’s password. Root cron invoked a user-writable /etc/print.sh we replaced with a reverse shell.

Linux · FTP · Web · Privilege Escalation

Foundations Linux engagement: Fuel CMS 1.4.1 (CVE-2018-16763) accepted pre-auth PHP evaluation via /fuel/pages/select filter; reverse shell as www-data; root password reused from application/config/database.php.

RCE · CMS · Credential Reuse · Privilege Escalation

Foundations web engagement: HTML comment leaked guest:guest; profile.php?user= accepted horizontal privilege escalation to the admin profile.

Web · IDOR · Access Control

Foundations crypto engagement: classified MD5/SHA1/SHA256/bcrypt and salted digests, then recovered plaintexts with rockyou via hashcat and john — companion briefing to Crack the Hash Level 2.

Password Cracking · Hashcat · John · Hash Identification

Foundations Linux engagement: corrupted JPEG and secret brute led to steghide payloads; ROT13 username joker plus banner stego unlocked SSH; Screen 4.5.0 SUID (EDB-41154) completed root.

Linux · Steganography · SSH · Privilege Escalation

Foundations web engagement: mapped URL anatomy, HTTP request/response structure, methods and security headers, then exercised GET/POST/DELETE against a lab API to recover three engagement artifacts.

HTTP · Web Fundamentals · API · Security Headers

Foundations network engagement: Hydra sprayed rockyou against Molly’s web login and SSH; both surfaces fell to weak passwords and yielded distinct engagement artifacts.

Brute Force · Hydra · SSH · Web Authentication

Foundations Windows engagement: Icecast on 8000 (CVE-2004-1561) yielded Meterpreter as Dark; bypassuac_eventvwr elevated integrity; migration into spoolsv.exe and kiwi recovered SYSTEM and credentials.

Windows · Icecast · Metasploit · Privilege Escalation

Foundations web engagement: vhost and low-priv login led to IDOR password disclosure; EJS CVE-2022-29078 yielded RCE as web; sudoedit with CVE-2023-22809-style editor injection rewrote sudoers for root.

Linux · Web · IDOR · SSTI · Privilege Escalation

Foundations crypto engagement: recovered the plaintext by inverting a Python enc() that Caesar-shifted each alphabetic character by its string index; non-letters unchanged.

Cryptography · Python · Code Review

Foundations Windows engagement: Jenkins on 8080 with admin:admin accepted Groovy RCE; Nishang reverse shell as bruce; Meterpreter Incognito impersonated BUILTIN\Administrators for SYSTEM-level access.

Windows · Jenkins · PowerShell · Token Impersonation

Foundations DFIR engagement: Elastic logs reconstructed Nmap/Gobuster/Hydra, admin brute force, webshell upload, LFI credential theft, and phpMyAdmin export of customer_credit_cards.

DFIR · Log Analysis · Web Attacks · Incident Response

Foundations Linux engagement: mafialive.thm LFI with filter bypass enabled Apache log poisoning to RCE; world-writable cron pivoted to archangel; SUID backup resolved cp from PATH for root.

Linux · LFI · Log Poisoning · Privilege Escalation

Foundations Linux engagement: SSH as new-user; find/grep/sha1sum/wc/ls -ln located planted files by group, IP content, hash, line count, UID, and world-execute bit.

Linux · Forensics · File Enumeration

Operator baseline on a Linux host: shell inventory, filesystem navigation, and Bash automation used to gate access and search logs under elevated privileges.

Linux · CLI · Bash · Scripting

Foundations AI engagement: nc to AI Command Executor on 1337; natural-language prompts generated sudo/root shell commands that listed and read /root/flag.txt.

LLM · Prompt Injection · AI Security

Foundations AI engagement: a single natural-language probe for purpose, rules, and admin/creator caused the model to dump system-level instructions containing the secret — follow-on to Evil-GPT command-executor abuse.

LLM · Prompt Injection · AI Security · System Prompt Leak

Foundations web engagement: Werkzeug login enabled arithmetic captchas after failed attempts; a custom client solved captchas while spraying usernames then passwords to recover a valid session.

Web · Authentication · Brute Force · Captcha Bypass

Foundations web engagement: /admin was bound to localhost:5000; Markdown HTML iframes caused the PDF renderer to fetch the internal page and embed the secret in the download.

Web · SSRF · PDF · Access Control

Foundations web engagement: corridor door links used MD5 hashes of sequential integers; rooms 1–13 were linked, md5(0) was omitted from the UI but directly addressable and returned the secret.

IDOR · Web Enumeration · Hashing

Foundations offensive tooling engagement: used msfconsole auxiliary scanners for ports/NetBIOS/SMB, cracked penny’s SMB password from rockyou, exploited a critical Windows service to Meterpreter, recovered flag.txt and pirate’s NTLM hash.

Metasploit · SMB · EternalBlue · Credential Access

Foundations post-exploitation engagement: in-memory Meterpreter on ACME-TEST/FLASH domain; enumerated user share speedster; dumped and cracked jchambers NTLM to Trustno1; located secrets.txt and realsecret.txt artifacts.

Meterpreter · Post-Exploitation · Credential Access · Windows

Foundations IoT engagement: Mosquitto broker accepted wildcard subscribe; a base64-encoded backdoor advertisement exposed pub/sub topics and a CMD interface that executed cat flag.txt.

MQTT · IoT · Command Injection · Network Enumeration

Foundations web engagement: lo-fi music site passed page paths into a file include; directory traversal read /etc/passwd and the root-level engagement artifact.

Web · LFI · Path Traversal

Foundations research engagement: evaluated sources, applied Google operators, queried Shodan/VirusTotal/HIBP, resolved CVE-2024-3094 to xz, and used man/Microsoft docs for command truth.

OSINT · Search · CVE · Documentation

Foundations tooling engagement: established Vim as the default remote editor — command/insert/visual modes, hjkl/we motion, insert/append, yank/delete/paste, search, and write/quit — for reliable work on constrained shells.

Vim · Linux · Operator Tooling

Foundations networking engagement: mapped OSI and TCP/IP layers to packet flow, then exercised ping, traceroute, dig/nslookup, and netstat/ss as the baseline operator toolkit for engagement scoping.

Networking · OSI · TCP/IP · DNS

Foundations Linux engagement: /panel rejected .php but accepted .php5 for a reverse shell as www-data; SUID /usr/bin/python spawned a root shell via GTFOBins.

Linux · Web · File Upload · Privilege Escalation

Foundations database engagement: Postgres on 5432 accepted postgres:password; Metasploit COPY FROM PROGRAM yielded an OS shell; credentials in dark’s home and config.php chained to alison with full sudo.

Linux · PostgreSQL · Metasploit · Credential Reuse

Foundations web engagement: Flask password-reset tokens were SHA1 of timestamp plus username; forged administrator access and SSRF dumped SQL; clarice SSH and cracked MySQL hashes reused as root.

Web · Crypto · SSRF · Privilege Escalation

Foundations web engagement: Werkzeug chat app accepted a .py profile upload that ran os.system reverse shell; callback returned root and the engagement artifact.

Web · File Upload · RCE

Foundations program engagement: briefed leadership on why vulnerability assessments and loud pentests do not measure detection; defined red/blue/white cells, crown jewels, TTPs, and mapped Mimikatz to Installation on the Lockheed Martin cyber kill chain.

Red Team · Adversary Emulation · Kill Chain · Detection

Windows Server assessment: Rejetto HFS 2.3 (CVE-2014-6287) via Metasploit as bill; PowerUp identified a restartable LocalSystem service with a writable binary path; msfvenom service EXE replacement yielded SYSTEM.

Windows · CVE · Metasploit · Privilege Escalation

Foundations crypto engagement: TCP service on 1337 returned hex XOR of a THM{} flag under a 5-character alphanumeric key; recovered four key bytes from known plaintext THM{, brute-forced the fifth, decrypted flag 1, and submitted the key for flag 2.

Cryptography · XOR · Known Plaintext · Python

Foundations web engagement: robots.txt disclosed /cupids_secret_vault/* and password cupid_arrow_2026!!!; admin login under that path returned the engagement artifact.

Web · Enumeration · Information Disclosure

Foundations program engagement: defined White/Black Hat boundaries and Rules of Engagement; mapped Information Gathering, OSSTMM, and OWASP methodologies; closed a guided ACME infrastructure exercise with THM{PENTEST_COMPLETE}.

Penetration Testing · ROE · Ethics · Methodology

Linux host assessment: anonymous SMB and NFS exposure, unauthenticated ProFTPd 1.3.5 SITE CPFR/CPTO abuse to exfiltrate an SSH private key, then PATH hijack of a SUID menu binary to root.

Linux · SMB · FTP · Privilege Escalation

Foundations web engagement: love-letter app assigned sequential archive numbers; authenticated users could open other users’ letters by changing the numeric id.

Web · IDOR · Access Control

Silverpeas on 8080 vulnerable to CVE-2024-36042 (password parameter omission). Authenticated IDOR on notifications exposed SSH credentials for tim. Auth logs leaked tyler’s password; tyler had full sudo.

Linux · CVE · Web · Credential Access

Foundations Linux engagement: anonymous SMB journal decoded to PNG stego; cracked archives and a cherry-blossom wordlist unlocked lily then johan; CVE-2019-18634 pwfeedback overflow completed root.

Linux · SMB · Steganography · Privilege Escalation

Linux assessment of BASIC2: anonymous Samba and a public /development path disclosed staff identities; Hydra recovered jan’s SSH password; kay’s world-readable id_rsa was cracked offline for lateral movement.

Linux · SMB · SSH · Credential Access

Foundations DFIR engagement: analyzed a business-email-compromise lure — subject reference, spoofed From/Reply-To, originating IP ownership, DNS auth records, and a mislabeled CAB attachment whose true type was RAR with a confirmed SHA256.

Phishing · Email Headers · SOC · Malware Triage

Foundations SOC engagement: classified ten inbox samples as phishing or legitimate by executive impersonation, macro attachments, survey links, credential-harvest pages, and look-alike payment URLs — closing with a verified triage artifact.

Phishing · SOC · Email Security · BEC

Foundations Linux engagement: provided frank SSH key; pspy showed root running bare sudo; PATH hijack of sudo captured frank’s password for root.

Linux · PATH Hijacking · Credential Theft · Privilege Escalation

Foundations Linux engagement: HTML comment leaked user jessie; /sitemap/.ssh/id_rsa enabled key auth; sudo NOPASSWD wget posted /root/root_flag.txt to the operator listener.

SSH · Web Enumeration · Privilege Escalation · GTFOBins

Foundations web engagement: customer feedback was rendered in the staff browser on the same host that listened on :8080/flag.txt; a stored XSS payload coerced the admin context to fetch and exfiltrate the secret.

XSS · Web Security · Browser Exploitation

Foundations web engagement: matchmaking survey reflected/stored attacker HTML; a fetch beacon exfiltrated the admin cookie to an operator listener.

Web · XSS · Session Theft

Foundations OSINT engagement: marvenly.com → uat-testing subdomain; footer username notvibecoder23 → GitHub repo; git log and older commits recovered email, abandonment note, and buried artifact.

OSINT · Git · Information Disclosure

Foundations network engagement: dual SSH listeners; Erlang/5.2.9 on 22 accepted CVE-2025-32433 pre-auth code execution via public PoC, writing lab.txt and delivering a reverse shell through os:cmd.

Network · SSH · RCE · Erlang

Foundations web engagement: TryHeartMe stored role and credits in a client-side JWT; forging admin with inflated credits unlocked the hidden catalog item.

Web · JWT · Authorization · Session Tampering

Apache gated content on User-Agent C (agent chris). Hydra cracked FTP; binwalk/zip2john and steghide recovered james’s SSH password. CVE-2019-14287 sudo -u#-1 bypass yielded root.

Linux · FTP · Steganography · CVE

Foundations risk engagement: classified OS privilege escalation and cookie-auth bypass as Operating System and Application Logic flaws; briefed CVSS qualitative bands and the role of CVE/NVD/Exploit-DB in engagement research.

Vulnerability Management · CVSS · CVE · Risk

Operator methodology for ffuf: directory and extension discovery, response filtering, GET/POST parameter and credential fuzzing, and Host-header vhost enumeration with noise reduction.

Web · Enumeration · ffuf

Foundations Linux engagement: themed web puzzles and stego yielded FTP credentials; a local binary brute-forced kidman’s SSH password; a world-writable root cron script completed privilege escalation.

Linux · Web · Stego · Privilege Escalation

Foundations Windows engagement: documented Pro-only BitLocker, NTFS, %windir%, UAC, lab user tryhackmebilly memberships, Guest account, and Ctrl+Shift+Esc Task Manager access for operator fluency on Windows endpoints.

Windows · NTFS · UAC · Endpoint

Intermediate remote-access engagement: AnyDesk 5.5.2 format-string RCE over UDP discovery (CVE-2020-13160 class) yielded a shell; SUID setcap plus cap_setuid on a copied python3 completed root.

Linux · AnyDesk · RCE · Capabilities

Intermediate container-to-host engagement: CVE-2021-41773 on Apache 2.4.49 yielded CGI RCE inside a container; CVE-2021-38647 (OMIGOD) against the Docker bridge gateway compromised the host.

Linux · Apache · Container · CVE

Intermediate OSINT/crypto engagement: spectrogram and cipher work recovered stego passphrases; outguess and SHA512 cracking led through Pastebin/Imgur to the final song identifier.

OSINT · Steganography · Cryptography · Hash Cracking

Intermediate Linux engagement: /api/bf executed Brainfuck that spawned a reverse shell; a root systemd unit invoked openssl with a loadable engine — a malicious .so completed privilege escalation.

Linux · RCE · Brainfuck · Privilege Escalation

Intermediate Linux engagement: extension-bypass PHP upload via a cloud UI yielded www-data; KeePass cracking recovered sysadmin SSH; a root cron include of backup.inc.php completed privilege escalation.

Linux · Web · KeePass · Privilege Escalation

Intermediate web engagement: coupon SQLi dumped WordPress hashes; theme editor RCE as www-data; Memcached held Orka credentials; sudo bitcoin resolved python from a writable PATH entry for root.

SQLi · WordPress · Memcached · Privilege Escalation

Intermediate themed engagement: anonymous FTP stego and a command panel yielded a shell; charlie’s SSH key from teleport; sudo vi escalated to root; a Fernet key from an earlier binary decrypted the root artifact.

Linux · Stego · Web · Privilege Escalation

Intermediate network assessment drill: full TCP inventory, banner harvesting, Hydra against vsftpd on a non-standard port, and null-scan IDS evasion — methodology without a full boot-to-root.

Network · Nmap · FTP · Hydra

Intermediate crypto engagement: haiti/hashcat/john workflow for exotic digests, John rule mangling and custom wordlists (Mentalist, CeWL, TTPassGen), then nine scenario hashes recovered from Password Advisor context.

Password Cracking · Hashcat · John · Wordlists

Intermediate Linux engagement: a Gunicorn homework uploader executed uploaded .hs files for RCE as flask; a readable prof SSH key yielded interactive access; sudo flask run with env_keep+=FLASK_APP spawned root Python.

Linux · Web · Haskell · Privilege Escalation

Intermediate Java middleware engagement: unauthenticated JBoss JMX console (CVE-2010-0738) accepted a Metasploit war deploy for a service shell; SUID pingsys command injection completed root.

Linux · JBoss · Metasploit · Privilege Escalation

Intermediate WordPress engagement: JSmol2WP SSRF/LFI read wp-config and a Hello Dolly backdoor for RCE; MySQL hashes and SSH key pivots through diego/think/gege reached xavi with unrestricted sudo.

WordPress · LFI · SSH · Privilege Escalation

Intermediate Linux engagement: robots and LFI exposed FTP credentials; writable FTP plus LFI yielded RCE; sudo, cron, and Python import hijacks moved laterally; an adm-readable backup key completed root over SSH.

Linux · LFI · FTP · Privilege Escalation

Intermediate web engagement: Hydra against a login oracle found jose; elFinder CVE-2019-9194 yielded www-data; SUID pwm PATH hijack unlocked think; sudo look read root’s SSH private key.

Web · elFinder · SSH · Privilege Escalation

Intermediate misconfiguration chain: NFS share readable after matching UID 1003; FTP wordlist forged admin PHPSESSID; command injection to shell; sudo apache2 with env_keep LD_LIBRARY_PATH enabled library hijack to root.

Linux · NFS · Web · Privilege Escalation

Intermediate network engagement: banner and NFS hints led to a crackable backup zip with hades’ SSH key; SSH on 3333 landed in IRB then bash; tar with cap_dac_read_search archived root’s artifact.

NFS · SSH · Capabilities · Privilege Escalation

Intermediate Linux engagement: UltraTech’s Node /ping API accepted shell metacharacters; SQLite hashes cracked to SSH as r00t; docker group membership mounted the host for root.

Linux · Command Injection · Docker · Privilege Escalation

Intermediate container engagement: index.php path parameter enabled RCE as www-data; SUID crypt binary dropped root in-container; mike’s SSH key pivoted to host2 where MySQL credentials enabled su to root.

Linux · Container · Web · Lateral Movement

Intermediate Linux engagement: /console exposed .phps sources and a weak MD5 password check; MFA brute and file browser yielded jason’s encrypted id_rsa; sudo to fred plus writable fail2ban actionban copied root.txt on SSH ban trigger.

Web Enumeration · SSH · Fail2Ban · Privilege Escalation

Intermediate web engagement: insecure pickle unpickle on a game-rating endpoint yielded www-data; mail and knockd opened SSH as dev1; writable knockd.conf plus sudo restart planted a SUID bash as root.

Web · Deserialization · Port Knocking · Privilege Escalation

Intermediate Linux engagement: themed path enumeration exposed SSH credentials; sudo Python imported attacker-writable random.py; SUID teaParty PATH-hijacked date; perl with cap_setuid completed root.

Linux · Web · Sudo · Capabilities

Intermediate Linux engagement: Sourcecodester Restaurant Management System on a nonstandard HTTP port accepted an unauthenticated upload (EDB-47520); fstab credentials unlocked SSH as edward; a world-writable systemd unit plus sudo reboot rewrote sudoers for root.

Linux · Web · Systemd · Privilege Escalation

Intermediate SSH engagement: password spray into a restricted rzsh; Rails-style constantize abuse escaped the jail; a localhost Ruby console planted a SUID bash for root.

Linux · SSH · Restricted Shell · Privilege Escalation

Intermediate CMS engagement: unauthenticated SPIP RCE (CVE-2023-27372) stole think’s SSH key; AppArmor blocked /opt until an unconfined bash in /dev/shm; rewriting run_container.sh planted SUID bash.

Linux · SPIP · AppArmor · Privilege Escalation

Intermediate Linux engagement: bank portal registration abused SQL truncation to seize admin; XXE on forms.php read acc.php credentials for SSH as cyber; a sudo-allowed run.py path was overwritten for root.

Linux · Web · XXE · Privilege Escalation

Intermediate web-to-root engagement: SQL injection unlocked an LFI endpoint; PHP filter chains delivered RCE; a writable authorized_keys and sudo over exploit.timer planted SUID xxd used to write root’s SSH key.

Linux · SQLi · PHP · Privilege Escalation

Intermediate Linux engagement: multi-port SSH puzzle and Alphabet Cipher yielded jabberwock; writable cron script pivoted laterally; alice’s key and sudo -h ssalg-gnikool completed root.

Linux · SSH · Cron · Sudo

Intermediate container engagement: nested SSRF into api-dev-backup enabled OS command injection and git history secrets; port knock opened Docker TCP 2375; host filesystem mount via alpine chroot recovered true root.

Web · SSRF · Docker · Container Escape

Intermediate application engagement: stored XSS stole an admin JWT; SQLi on /admin leaked messages; sudo backup as michael abused tar checkpoints; Docker mount escaped to host root.

Web · XSS · SQLi · Docker

Intermediate web engagement: dating-app layout API accepted path traversal without auth; /proc and app source leaked a static admin token used to export the full SQLite user database.

Web · LFI · Source Disclosure · API Auth

Intermediate web engagement: recovered twenty engagement artifacts from a deliberately noisy web surface — bots, encoding, hidden DOM/JS, SQLi, cookies, embeds, and HTML/JS tampering — documented as a client-side and injection enumeration checklist.

Web Enumeration · Client-Side · Injection · OSINT

Intermediate Linux engagement: robots.txt leaked a wordlist and first artifact; Hydra recovered elliot’s WordPress password for a theme-editor shell; robot’s MD5 cracked for su; SUID nmap --interactive completed root.

Linux · WordPress · Hydra · Privilege Escalation

Intermediate Linux engagement: anonymous rsync module Conf allowed rewriting webapp.ini prod to dev; Union SQLi on /admin yielded OS shell as tom; tcpdump on lo captured a root SSH private key from an internal service.

Rsync · SQL Injection · Traffic Capture · Privilege Escalation

Advanced DFIR engagement: reconstructed attacker path from compromised email credentials through an IEX download cradle, recovered the initial AES C2 key, and documented the Administrator NTLM hash taken from the host.

DFIR · PowerShell · C2 · Credential Theft

Advanced boot2root engagement: PadBuster forged an administrator session cookie; AES-CBC material from robots/iv.png and a secondary service recovered SSH creds; SUID binary buffer overflow / SROP yielded root.

Padding Oracle · Cryptography · Reverse Engineering · Binary Exploitation

Advanced DFIR engagement: Wireshark capture of an AD compromise — open-port SYN/ACK map, AS-REP etype 23 for larry.doe cracked to Password1!, WinRM traffic decrypted to recover SAM/SYSTEM dump commands and the planted artifact.

DFIR · Kerberos · WinRM · Active Directory

Advanced Windows engagement: demonstrated tool-agnostic process injection, process hollowing, thread hijacking, and DLL injection against lab targets; documented APC/QueueUserAPC and TrickBot-style reflective hooking notes for detection engineering.

Windows Internals · Process Injection · Evasion · DFIR