YYogeshwar Peela·Oct 7TryHackMe - SeaSurfer writeupComplete Sea Surfer TryHackMe writeup covering vhost enumeration, SSRF, LFI, WordPress RCE, tar wildcard injection, and SSH agent privilege escalation15 min read·exploitnotes.hashnode.dev
YYogeshwar Peela·Jul 2HackTheBox: LustrousTwo WriteupComplete Lustrous2 HTB walkthrough covering Kerberos auth, LuShare LFI, S4U2self abuse, and SYSTEM via Velociraptor.21 min read·exploitnotes.hashnode.dev
WWiktoria Blomgren Strandberg·May 5File Inclusion in DVWADocumented penetration test of the File Inclusion vulnerability in DVWA.22 min read·pentesting-dvwa.hashnode.dev
JJebitok·Mar 28Team (CTF Challenge - THM)nmap -p- -sV IP_Address PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.5 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache h8 min read·sharonjebitok.com
JJebitok·Feb 20Speed Chatting🎉🚩 - Unrestricted File Upload RCE (LFI)Description Speed Chatting is an AI Security Challenge that was part of the Love at First Breach 2026, red team beginner’s CTF. It covers prompt injection and system configuration vulnerabilities in A4 min read·sharonjebitok.com
Ss1de·Feb 8Archangel Writeup: Log Poisoning and $PATH Hijacking on TryHackMeMaster the Archangel CTF: Bypass LFI filters, execute RCE via Apache log poisoning, and hijack SUID $PATH for root privilege escalation. Step-by-step guide.12 min read·s1de.hashnode.dev
MMate Agulashvili·Jan 19LFI → RCE: Abusing Stream Wrappers with Uploaded Microsoft DOCX FilesUsing Microsoft documents and LFI to achieve RCE in PHP7 min read·noteshacking.hashnode.dev
JJebitok·Jan 15Challenge: Tokyo Ghoul (TryHackMe)Introduction Tokyo Ghoul CTF Challenge - A Complete Walkthrough This write-up documents my journey through the "Tokyo Ghoul" room on TryHackMe, a beginner-to-intermediate level capture-the-flag challenge inspired by the popular anime series. This roo...9 min read·sharonjebitok.com
PPradip Bhattarai·Aug 11, 2025Exploiting an LFI Vulnerability and Forging a Signature in BugcrowdCTFGuide to exploiting LFI vulnerabilities, forging signatures, reverse-engineering, and crafting a Python script in BugcrowdCTF5 min read·blog.pradeepbhattarai.me
JJebitok·Aug 8, 2025Challenges: Archangel (TryHackMe)The Archangel challenge simulated a real-world vulnerable web application environment where misconfigurations and insecure coding practices could be chained together for full system compromise. The target machine hosted multiple virtual hosts and dev...6 min read·sharonjebitok.com
