YPYogeshwar Peelainexploitnotes.hashnode.dev·5d ago · 6 min readTryHackMe : Towel on the Sunbed WriteupTL;DR Ponzi Portfolio is a Node.js/Express "staking rewards" web app with a 24-hour cooldown on claiming a reward. The /claim endpoint has a classic check-then-act race condition: it checks whether th10
YPYogeshwar Peelainexploitnotes.hashnode.dev·5d ago · 8 min readTryHackMe : Do Not Disturb WriteupTL;DR Byte Lotus Poolside is a Node.js/Express booking app. A NoSQL injection in the login endpoint bypasses authentication entirely and lands directly in the staff role. The staff console's booking-c10
YPYogeshwar Peelainexploitnotes.hashnode.dev·6d ago · 7 min readTryHackMe : Beach Bar WriteupTL;DR Beach Bar is a Flask-based "DJ booth" web app for a beach bar jukebox. Default demo credentials (dj/dj) left enabled in an HTML comment get you into the dashboard, which exposes a YAML playlist 10
OKOthman Kamalinthm-write-ups.hashnode.dev·Jun 30 · 5 min readPickle Rick NOTE: My IP address will be different from yours! This Ricky and Morty themed challenge requires you to exploit a webserver to find three ingredients that will help Rick make his potion to transform00
SSl4cK0THinz2r.zor0ark.me·May 6 · 7 min readTryHackMe — Recruit WalkthroughChallenge Link: https://tryhackme.com/room/recruitwebchallenge Introduction The "Recruit" challenge on TryHackMe is a fantastic playground for demonstrating how low-severity vulnerabilities can be ch10
SSl4cK0THinz2r.zor0ark.me·May 1 · 5 min readTHM Writeup | BankGPTTitle: BankGPT | Cateogry: AI/LLM Pentesting | Difficulty: Easy Challenge Link (For Subscription-User Only):https://tryhackme.com/room/bankgpt Introduction Large Language Models (LLMs) are increasing00
HMHarsh Mishrainwriteups.dazaionline.org·Apr 12 · 2 min readThe GameIntroduction The Game is a reverse-engineering / binary analysis challenge. The premise: a cipher hid critical secrets inside a Tetris binary. The goal is to analyze the supplied binary, extract the e00
SsOn4jitinblog.sonajit.in·Dec 11, 2025 · 5 min readTHM Merry XSSmas Writeup: Learning Reflected and Stored XSS AttacksIntroduction The Merry XSSmas room demonstrates how improper input handling can lead to dangerous client-side vulnerabilities. This challenge focuses on two common web vulnerabilities: Reflected XSS 20
SsOn4jitinblog.sonajit.in·Dec 5, 2025 · 5 min readTHM W1seGuy Writeup: Learning XOR Weakness and Known Plaintext AttacksIntroduction The W1seGuy room demonstrates a classic cryptographic mistake: using XOR encryption with a short repeating key. This challenge highlights how predictable plaintext combined with weak XOR 10
TThacklabintry-hack-me-write-ups.hashnode.dev·Nov 21, 2025 · 4 min readTHM - Break Out the Cage: Step-by-Step GuideInitial Reconnaissance sudo nmap -sS -sV -T4 TARGET_IP -vvv Key Findings: HTTP service running FTP service running SSH service available Directory Discovery The main HTTP page showed Nicolas Cage content with limited information The directory b...00
