--- title: "#offensive-security articles | Hashnode" description: "Explore 107 articles tagged #offensive-security on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/offensive-security" --- Tag # #offensive-security 107 posts · 31 followers [Nytcc](https://hashnode.com/@nytcc1) · [Oct 30](https://hashnode.com/posts/osep-certification-exam-guide-exam-format-preparation-and-reporting/6ae43804d1a9a98a3fcd7909) ### [OSEP Certification Exam Guide: Exam Format, Preparation, and Reporting](https://nytcc.hashnode.dev/osep-certification-exam-guide-exam-format-preparation-and-reporting?utm_source=hashnode&utm_medium=feed) Prepare for the OSEP certification exam with PEN-300 topics, exam format, core skills, a study plan, readiness tips, and report requirements for 2026. 9 min read · [nytcc.hashnode.dev](https://nytcc.hashnode.dev/osep-certification-exam-guide-exam-format-preparation-and-reporting?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Sep 28](https://hashnode.com/posts/tryhackme-binary-heaven-writeup/6aba88d702e827109be86b0b) ### [TryHackMe: Binary Heaven - Writeup](https://exploitnotes.hashnode.dev/tryhackme-binary-heaven-writeup?utm_source=hashnode&utm_medium=feed) TryHackMe Binary Heaven walkthrough: Ghidra,GDB, reverse engineering, ret2libc, SUID exploitation, PATH hijacking, and Linux privilege escalation tips 8 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-binary-heaven-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Sep 22](https://hashnode.com/posts/tryhackme-adventure-time-writeup/6ab27264ae7f6a9040b5cb59) ### [TryHackMe: Adventure Time Writeup](https://exploitnotes.hashnode.dev/tryhackme-adventure-time-writeup?utm_source=hashnode&utm_medium=feed) Adventure Time TryHackMe writeup covering FTP EXIF clues, web puzzles, Morse, AES, Vigenère, Spoon, steganography, and Exim CVE-2019-10149. 11 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-adventure-time-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Sep 22](https://hashnode.com/posts/tryhackme-python-playground-writeup/6ab26fe5d90980069bb54b19) ### [TryHackMe: Python Playground Writeup](https://exploitnotes.hashnode.dev/tryhackme-python-playground-writeup?utm_source=hashnode&utm_medium=feed) Python Playground TryHackMe writeup covering Python sandbox bypass, RCE, credential recovery, Docker container escape, and SUID privilege escalation. 8 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-python-playground-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Sep 1](https://hashnode.com/posts/webversepro-snowedout-writeup/6a96cbdf9d4951f2dcb9645a) ### [WebVersePro : SnowedOut writeup](https://exploitnotes.hashnode.dev/webversepro-snowedout-writeup?utm_source=hashnode&utm_medium=feed) SnowedOut on WebVerseLabs Pro: exploit Pinehollow Plow Tracker with JavaScript injection and forged CSP reports to retrieve the flag. 6 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/webversepro-snowedout-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 23](https://hashnode.com/posts/brunnerctf-2026-the-three-ways-writeup/6a8b17fec9ed6fd6e84326ef) ### [BrunnerCTF 2026 : The Three Ways Writeup](https://exploitnotes.hashnode.dev/brunnerctf-2026-the-three-ways-writeup?utm_source=hashnode&utm_medium=feed) The Three Ways BrunnerCTF 2026 writeup: exploit Gitea, Drone CI, leaked secrets, and an unsigned rollout agent to gain root access. 18 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/brunnerctf-2026-the-three-ways-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 23](https://hashnode.com/posts/brunnerctf-2026-magic-or-not-writeup/6a8b1960e84c0d73dade1301) ### [BrunnerCTF 2026 : Magic or Not Writeup](https://exploitnotes.hashnode.dev/brunnerctf-2026-magic-or-not-writeup?utm_source=hashnode&utm_medium=feed) Magic or Not BrunnerCTF 2026 writeup: crack single-byte XOR using image magic bytes, decode four slices, and stitch them to recover the flag. 6 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/brunnerctf-2026-magic-or-not-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 23](https://hashnode.com/posts/brunnerctf-2026-half-baked-writeup/6a8b1ada81bd53a5193f57f7) ### [BrunnerCTF 2026 : Half Baked Writeup](https://exploitnotes.hashnode.dev/brunnerctf-2026-half-baked-writeup?utm_source=hashnode&utm_medium=feed) Half Baked BrunnerCTF 2026 writeup: reconstruct a PyTorch model, chain six layers, restore ReLU activations, and decode the hidden flag. 13 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/brunnerctf-2026-half-baked-writeup?utm_source=hashnode&utm_medium=feed) [Uday Bhale](https://hashnode.com/@rudraub) · [Aug 17](https://hashnode.com/posts/part-3-admin-panel-to-rce/6a8336abc94bcc122d4a3d4f) ### [Part 3: From Admin Panel to Remote Code Execution](https://hackwithrudraub.hashnode.dev/part-3-admin-panel-to-rce?utm_source=hashnode&utm_medium=feed) Follow a web pentest attack chain from admin panel access and file upload bypass to RCE, web shell, reverse shell, and server compromise. 7 min read · [hackwithrudraub.hashnode.dev](https://hackwithrudraub.hashnode.dev/part-3-admin-panel-to-rce?utm_source=hashnode&utm_medium=feed) [Daniel Isaac E](https://hashnode.com/@Daniel-Isaac-E) · [Aug 15](https://hashnode.com/posts/the-endpoint-wasn-t-vulnerable-the-attack-chain-was/6a80c023c49321676a19c5df) ### [The Endpoint Wasn't Vulnerable. The Attack Chain Was.](https://danielisaace.hashnode.dev/the-endpoint-wasn-t-vulnerable-the-attack-chain-was?utm_source=hashnode&utm_medium=feed) Introduction The first finding wasn't critical. It wasn't even particularly interesting. There was no SQL Injection. No Remote Code Execution. No authentication bypass. Just an API endpoint that shoul 9 min read · [danielisaace.hashnode.dev](https://danielisaace.hashnode.dev/the-endpoint-wasn-t-vulnerable-the-attack-chain-was?utm_source=hashnode&utm_medium=feed)