YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 10 · 13 min readTryHackMe : Dreaming WriteupSummary Dreaming is a Linux box built around a Pluck CMS install. Brute-forcing the CMS admin login gives access to the admin panel, which is then abused via a known authenticated file-upload RCE (CVE11N
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 11 · 18 min readTryHackMe : The London Bridge writeupSummary The London Bridge is built around a Flask "Explore London" gallery app served behind Gunicorn. A hidden /view_image endpoint takes a form-encoded URL and fetches it server-side - classic SSRF 11N
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 10 · 15 min readTryHackMe : WhyHackMe writeupSummary WhyHackMe is an medium Linux box that chains a handful of low-friction bugs into root. Anonymous FTP leaks a hint pointing at a pass.txt file that's only reachable from localhost. The blog app10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 4 · 6 min readTryHackMe : Towel on the Sunbed WriteupTL;DR Ponzi Portfolio is a Node.js/Express "staking rewards" web app with a 24-hour cooldown on claiming a reward. The /claim endpoint has a classic check-then-act race condition: it checks whether th10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 4 · 8 min readTryHackMe : Do Not Disturb WriteupTL;DR Byte Lotus Poolside is a Node.js/Express booking app. A NoSQL injection in the login endpoint bypasses authentication entirely and lands directly in the staff role. The staff console's booking-c10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 4 · 5 min readTryHackMe : Overheard at BreakfastTL;DR A single artifact - a zipped screenshot of a Discord-style DM conversation is the entire challenge. Two "Byte Lotus Hotel" guests, Ponzi and Lambo!, chat about social media; Lambo! name-drops a10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 4 · 6 min readTryHackMe : Packed Light WriteupTL;DR A .pcapng capture shows a victim host on 192.168.1.141 downloading a Python keylogger (updates.py) from an attacker-controlled "hotel update server" at byte-lotus-hotel.thm:8080 (34.41.103.191).10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 4 · 7 min readTryHackMe : Beach Bar WriteupTL;DR Beach Bar is a Flask-based "DJ booth" web app for a beach bar jukebox. Default demo credentials (dj/dj) left enabled in an HTML comment get you into the dashboard, which exposes a YAML playlist 10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 22 · 8 min readTryHackMe : FoolMate WriteupSummary Endgame Trainer is a small web app that presents a "mate-in-one" chess puzzle. The board is legit (built on the chess.js library), but the app has a gimmick: if you actually play the winning m00
SsOn4jitinblog.sonajit.in·Dec 11, 2025 · 5 min readTHM Merry XSSmas Writeup: Learning Reflected and Stored XSS AttacksIntroduction The Merry XSSmas room demonstrates how improper input handling can lead to dangerous client-side vulnerabilities. This challenge focuses on two common web vulnerabilities: Reflected XSS 20
