00ordin0ord.hashnode.dev·Jul 23 · 7 min readHackTheBox Monitors WalkthroughHackTheBox Monitors Walkthrough HасkTheBox іs a pоpulаr ѕеrvіce offering оvеr 240 maсhіnеѕ and tоnѕ of challenges so you can extend and improve your cybersecurity skills. HTB Monitors is an advanced 01F
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 14 · 9 min readHackTheBox : JinjaCareSummary JinjaCare is a Flask-based COVID-19 vaccination verification web app. The intended path chains wkhtmltopdf HTML/local-file injection (via the certificate-generation feature) to disclose the Fl00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 13 · 8 min readHackTheBox: NeoVault Challenge WriteupSummary NeoVault is a small banking app (Next.js frontend + REST API) that lets users register, transfer funds, and download PDF statements. The API ships in two parallel versions, v1 and v2. v2 patch00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 2 · 7 min readHackTheBox: vulnEscape WriteupSummary Escape is a Windows box that exposes only RDP (3389). The RDP session drops you into a locked-down kiosk account (KioskUser0) meant for a "Conference Display" app. The box is solved entirely t00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 1 · 9 min readHackTheBox: Reset WriteupSummary Reset is a Linux box built around a chain of web application logic flaws and a legacy authentication misconfiguration. Initial access starts with a password reset endpoint that leaks the new a00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jun 29 · 10 min readHackTheBox: Sendai WriteupSummary Sendai is a Windows Active Directory machine exposed with SMB guest access. RID brute-forcing reveals a full user list, and two accounts have expired passwords that can be reset with no knowle00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jun 28 · 7 min readHackTheBox: Sloink WriteupSummary NFS shares exposed the target's home directory and PostgreSQL backups. The user's psql history contained an MD5 hash that cracked to service. SSH with that account drops you immediately (shell00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jun 27 · 11 min readHackTheBox: Down WriteupExecutive Summary Down is an easy Linux machine running a simple "Is it down or just me?" web checker. The site uses curl server-side to test URLs - making it a classic SSRF target. The protocol filte00
APAmal PKinblog.amalpk.in·May 8 · 7 min readHackthebox Fluffy Walkthrough — Windows Seasonal BoxFluffy is a realistic Windows Active Directory (AD) machine on Hack The Box's Seasonal track that simulates a corporate environment with common misconfigurations and vulnerabilities often seen in real00
Cctfsecinblog.ctfsecurity.com·May 2 · 2 min readHackTheBox: Freelancer - Blind SQLi to Domain AdminFreelancer is a medium-rated HackTheBox machine that chains a blind SQL injection vulnerability into full Active Directory compromise. Here's my full walkthrough. Reconnaissance Starting with a standa00
