Linux Insane: STACKEDStacked is an insane Linux box built around a LocalStack container, an AWS service emulator running on the target itself. It teaches how a blind XSS in a header nobody sanitized leads to an internal hSep 7 · 8 min readkohicha.dev
HTB Linux Medium: EpsilonEpsilon is a medium Linux box built around a leaked git repository and a locally emulated AWS environment: https://app.hackthebox.com/machines/Epsilon. It teaches how a single exposed .git directory tSep 3 · 9 min readkohicha.dev
Cloudgoat Hard: RCE Web AppIn this lab, we'll be doing a walkthrough on the rce_web_app cloudgoat scenario. It hands us two separate low-privilege users, Lara and McDuck, and two completely different ways in. Both end at the saSep 1 · 6 min readkohicha.dev
Cloudgoat Medium: EC2 SSRFIn this lab, we'll be doing a walkthrough on the ec2_ssrf cloudgoat scenario. It's rated moderate, and the goal is to invoke a specific Lambda function that we don't start with permission to touch. Su2Aug 24 · 6 min readkohicha.dev
Cloudgoat Medium: StaticIn this lab, we'll be doing a walkthrough on the static cloudgoat scenario. Heads up: I had to patch this challenge because the login bot was returning an error. As of 08-22-2026 there's no fix upstr3Aug 22 · 6 min readkohicha.dev
