YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 12 · 7 min readTryHackMe : Lookup writeupSummary Lookup is an easy Linux box built around a login portal that redirects authenticated users to a vhost-hosted elFinder file manager. Username enumeration on the login form combined with passwor11N
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 4 · 8 min readTryHackMe : Do Not Disturb WriteupTL;DR Byte Lotus Poolside is a Node.js/Express booking app. A NoSQL injection in the login endpoint bypasses authentication entirely and lands directly in the staff role. The staff console's booking-c10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 4 · 7 min readTryHackMe : Beach Bar WriteupTL;DR Beach Bar is a Flask-based "DJ booth" web app for a beach bar jukebox. Default demo credentials (dj/dj) left enabled in an HTML comment get you into the dashboard, which exposes a YAML playlist 10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jun 27 · 18 min readHackTheBox: FireFlow WriteupExecutive Summary FireFlow is a Linux machine running a fictional "Task Force Nightfall" intelligence platform. The web application exposes a Langflow instance (flow.fireflow.htb) with a public flow p00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jun 21 · 5 min readHackTheBox: Postman WriteupSummary Postman is an easy-rated Linux machine on HackTheBox. The box exposes an unauthenticated Redis instance that allows writing an SSH public key to the redis user's .ssh directory, granting initi00
VBVirusis Bloginblog.virusis.com·Apr 2 · 6 min read02/04/2026 Cyber Security Briefly News - Critical Exposures, Mobile Spyware, and Strategic Security Alignment: A Daily Cyber Intelligence Brief📋 Top Headlines at a Glance Over 14,000 F5 BIG-IP APM instances still exposed to RCE attacks Variance Raises $21.5M for Compliance Investigation Platform Powered by AI Agents Italian spyware vendor creates Fake WhatsApp app, targeting 200 users App...00
VBVirusis Bloginblog.virusis.com·Mar 25 · 5 min read25/03/2026 Cyber Security Briefly News - Escalating Cyber Threats & Strategic Defenses: A Multi-Vector Intelligence Brief📋 Top Headlines at a Glance Codenotary introduces AgentX for autonomous Linux infrastructure security HackerOne Employee Data Exposed in Massive Navia Breach FCC Bans New Foreign-Made Routers Over Supply Chain and Cyber Risk Concerns PTC warns of i...00
NINeville Iregiinm0ng00s3-blog.hashnode.dev·Mar 21 · 12 min readHack The Box Lab: ThreeOrganizations of every type, size, and industry are using the cloud for a wide variety of use cases, such as data backup, storage, disaster recovery, email, virtual desktops, software development and 00
EWEricson Williansinscarletbuffer.hashnode.dev·Feb 26 · 5 min readWhen Deserialization Meets eval(): Anatomy of a Full-Stack CompromiseSecurity incidents rarely hinge on a single catastrophic bug. More often, they emerge from layered design shortcuts — each individually survivable, but collectively fatal. This case study examines a r00
MAMate Agulashviliinnoteshacking.hashnode.dev·Jan 19 · 7 min readLFI → RCE: Abusing Stream Wrappers with Uploaded Microsoft DOCX FilesDuring an engagement, I identified a Local File Inclusion (LFI) vulnerability in a document transfer application written in plain PHP. Although the application enforced strict file upload controls—restricting uploads to .doc, .docx, and .pdf files an...00
