YYogeshwar PeelaOct 7 · 15 min readTryHackMe - SeaSurfer writeupExecutive Summary The engagement began with a single disclosed virtual host name leaking out of an HTTP response header on the target web server. That one leak unraveled the entire box: it led to a Woexploitnotes.hashnode.dev
YYogeshwar PeelaSep 22 · 8 min readTryHackMe: Python Playground WriteupSummary Python Playground is a hard-rated TryHackMe box built around a "sandboxed" Python code execution service fronted by a Node.js/Express web app. The site advertises a blacklist-based filter thatexploitnotes.hashnode.dev
YYogeshwar PeelaSep 10 · 10 min readTryHackMe - Olympus WriteupSummary Olympus is a Linux box built around an old Victor CMS 1.0 install hidden under /~webmaster/. An unauthenticated SQL injection in the CMS search feature was the root of the entire chain: it dumexploitnotes.hashnode.dev
YYogeshwar PeelaAug 23 · 18 min readBrunnerCTF 2026 : The Three Ways WriteupSummary Two connected challenges built around the same Gitea/Drone/rollout-agent environment. The first stage (Flow) gets code execution on the Drone CI runner. The second stage (Feedback / Continuousexploitnotes.hashnode.dev
LLưu Tuấn AnhAug 20 · 12 min readWindRelay: New Malware Duo Behind the Wave of FraudOverview Did you know that it only takes 13 short minutes from the moment the victim picks up the phone to receive the support call from the "bank employee" until all the money in the account is evapoblog.fiscybersec.com
YYogeshwar PeelaAug 18 · 8 min readTryHackMe : Athena WriteupOverview Athena is an easy-rated TryHackMe box that chains a leaked internal path (found via an anonymous SMB share) into a command injection vulnerability in a "router panel" ping tool, followed by aexploitnotes.hashnode.dev
YYogeshwar PeelaAug 15 · 11 min readTryHackMe : Different CTF writeupSummary Different CTF is an easy-rated Linux box built around a WordPress install with an exposed wp-config.php, an FTP service reachable with credentials hidden inside a steganographic image, and a cexploitnotes.hashnode.dev
YYogeshwar PeelaAug 7 · 11 min readTryHackMe : Infinity Pool WriteupSummary Recon on <MACHINE_IP> revealed a Gunicorn-hosted "Byte Lotus" hotel site with two paths disallowed in robots.txt - /internal/ and /status. The /status page exposes an internal staff tool ("Sis21Nexploitnotes.hashnode.dev
NNeville IregiMay 5 · 9 min readHack The Box: PennyworthPennyworth is a Linux machine that focuses on exploiting weak credentials and remote command execution in. Default credentials can be used to get administrative access into Jenkins with which the Scrim0ng00s3-blog.hashnode.dev
Rrecca0120Apr 21 · 3 min readreverse_ssh: Manage Reverse Shells With Native SSH Syntax, No VPN RequiredOriginally published at recca0120.github.io You need to connect to a machine behind NAT with no public IP and inbound traffic blocked. The usual answers are VPN or ngrok-style tunnels, but both require setup on the target. reverse_ssh has the target ...recca0120.hashnode.dev
