YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 11 · 18 min readTryHackMe : The London Bridge writeupSummary The London Bridge is built around a Flask "Explore London" gallery app served behind Gunicorn. A hidden /view_image endpoint takes a form-encoded URL and fetches it server-side - classic SSRF 11N
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 10 · 15 min readTryHackMe : WhyHackMe writeupSummary WhyHackMe is an medium Linux box that chains a handful of low-friction bugs into root. Anonymous FTP leaks a hint pointing at a pass.txt file that's only reachable from localhost. The blog app10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 4 · 6 min readTryHackMe : Towel on the Sunbed WriteupTL;DR Ponzi Portfolio is a Node.js/Express "staking rewards" web app with a 24-hour cooldown on claiming a reward. The /claim endpoint has a classic check-then-act race condition: it checks whether th10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 4 · 8 min readTryHackMe : Do Not Disturb WriteupTL;DR Byte Lotus Poolside is a Node.js/Express booking app. A NoSQL injection in the login endpoint bypasses authentication entirely and lands directly in the staff role. The staff console's booking-c10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 4 · 7 min readTryHackMe : Beach Bar WriteupTL;DR Beach Bar is a Flask-based "DJ booth" web app for a beach bar jukebox. Default demo credentials (dj/dj) left enabled in an HTML comment get you into the dashboard, which exposes a YAML playlist 10
OKOthman Kamalinthm-write-ups.hashnode.dev·Jun 30 · 5 min readPickle Rick NOTE: My IP address will be different from yours! This Ricky and Morty themed challenge requires you to exploit a webserver to find three ingredients that will help Rick make his potion to transform00
SSl4cK0THinz2r.zor0ark.me·May 6 · 7 min readTryHackMe — Recruit WalkthroughChallenge Link: https://tryhackme.com/room/recruitwebchallenge Introduction The "Recruit" challenge on TryHackMe is a fantastic playground for demonstrating how low-severity vulnerabilities can be ch10
SSl4cK0THinz2r.zor0ark.me·May 1 · 5 min readTHM Writeup | BankGPTTitle: BankGPT | Cateogry: AI/LLM Pentesting | Difficulty: Easy Challenge Link (For Subscription-User Only):https://tryhackme.com/room/bankgpt Introduction Large Language Models (LLMs) are increasing00
HMHarsh Mishrainwriteups.dazaionline.org·Apr 12 · 2 min readThe GameIntroduction The Game is a reverse-engineering / binary analysis challenge. The premise: a cipher hid critical secrets inside a Tetris binary. The goal is to analyze the supplied binary, extract the e00
SsOn4jitinblog.sonajit.in·Dec 11, 2025 · 5 min readTHM Merry XSSmas Writeup: Learning Reflected and Stored XSS AttacksIntroduction The Merry XSSmas room demonstrates how improper input handling can lead to dangerous client-side vulnerabilities. This challenge focuses on two common web vulnerabilities: Reflected XSS 20
