VGVivek Goswamiinvivekgoswami.hashnode.dev·6d ago · 2 min readZico2 - Vulnhub 2026 WriteupBox: Zico2: 1 Author: Rafael Difficulty: Beginner–Intermediate Download: https://www.vulnhub.com/entry/zico2-1,210/ Goal: Get a foothold on the web server, pivot to a local user, then escalate to root10
VGVivek Goswamiinvivekgoswami.hashnode.dev·Sep 3 · 5 min readMidnight Sunset Walkthrough 2026 - Proving Grounds/VulnhubStart by downloading the Vulnerable machine from - https://www.vulnhub.com/entry/sunset-midnight,517/ Add it to virtual box and adjust the network setting as per your convenience , i set it to host on10
MSMOHIT SINGH PAPOLAinblog.reapsec.com·Aug 6 · 6 min readSendaiOVERVIEW So we have been told the user flag will be in C:/ directory and also gave us the target IP address Let's start the enumeration using NMAP ENUMERATION Let's start with Anonymous Login with00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 14 · 9 min readHackTheBox : JinjaCareSummary JinjaCare is a Flask-based COVID-19 vaccination verification web app. The intended path chains wkhtmltopdf HTML/local-file injection (via the certificate-generation feature) to disclose the Fl00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 13 · 8 min readHackTheBox: NeoVault Challenge WriteupSummary NeoVault is a small banking app (Next.js frontend + REST API) that lets users register, transfer funds, and download PDF statements. The API ships in two parallel versions, v1 and v2. v2 patch00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 2 · 7 min readHackTheBox: vulnEscape WriteupSummary Escape is a Windows box that exposes only RDP (3389). The RDP session drops you into a locked-down kiosk account (KioskUser0) meant for a "Conference Display" app. The box is solved entirely t00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 1 · 9 min readHackTheBox: Reset WriteupSummary Reset is a Linux box built around a chain of web application logic flaws and a legacy authentication misconfiguration. Initial access starts with a password reset endpoint that leaks the new a00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jun 29 · 10 min readHackTheBox: Sendai WriteupSummary Sendai is a Windows Active Directory machine exposed with SMB guest access. RID brute-forcing reveals a full user list, and two accounts have expired passwords that can be reset with no knowle00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jun 28 · 7 min readHackTheBox: Sloink WriteupSummary NFS shares exposed the target's home directory and PostgreSQL backups. The user's psql history contained an MD5 hash that cracked to service. SSH with that account drops you immediately (shell00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jun 27 · 11 min readHackTheBox: Down WriteupExecutive Summary Down is an easy Linux machine running a simple "Is it down or just me?" web checker. The site uses curl server-side to test URLs - making it a classic SSRF target. The protocol filte00
