Tag feed

#web-exploitation

32 posts12 followers

Explore Hashnode

Alternatives

Trending tags this week

YPYogeshwar Peelaexploitnotes.hashnode.dev19h ago · 7 min read

FAM CTF : The Cloud writeup

Summary The target exposed a webhook endpoint (/internal/webhook) meant to act as an internal-only proxy, blocking direct requests to private and link-local IP ranges. That blocklist checked resolved

0

YPYogeshwar Peelaexploitnotes.hashnode.dev18h ago · 4 min read

FAM CTF : The Vault Door Writeup

Summary NexaVault is a mock internal dashboard app that gates an "Admin Vault" panel behind a role claim in a JWT. The app issues a user-role token on login, stored in the nx_access cookie, and trusts

0

YPYogeshwar Peelaexploitnotes.hashnode.dev1d ago · 4 min read

HackTheBox : Void Whispers Writeup

Summary The "Void Whispers" mail-settings panel passes the user-supplied sendMailPath field directly into shell_exec("which $sendMailPath") with no escaping. The app only filters literal whitespace, w

0

YPYogeshwar Peelaexploitnotes.hashnode.dev1d ago · 19 min read

HackTheBox : Race Writeup

Summary Race is a Linux box built around Grav CMS. The path in is a chain of small information leaks rather than one big bug: an exposed phpsysinfo instance with default creds leaks a process list, th

0

YPYogeshwar Peelaexploitnotes.hashnode.dev5d ago · 8 min read

HackTheBox: NeoVault Challenge Writeup

Summary NeoVault is a small banking app (Next.js frontend + REST API) that lets users register, transfer funds, and download PDF statements. The API ships in two parallel versions, v1 and v2. v2 patch

0

YPYogeshwar Peelaexploitnotes.hashnode.devJul 4 · 10 min read

HackTheBox: Watcher Writeup

Summary Watcher is a Linux box built around a self-hosted Zabbix monitoring stack. The front door isn't a permissions misconfig at all - it's a real Zabbix CVE (CVE-2024-22120), a time-based blind SQL

0

YPYogeshwar Peelaexploitnotes.hashnode.devJun 8 · 4 min read

Heart Part 7 — dalCTF 2026

Category: WebFlag: dalctf{p1mp_p1mp_h00r4y} Overview A multi-stage web challenge themed around Kendrick Lamar's m.A.A.d city / Kung Fu Kenny lore. The attack chain involved: SQL injection to bypas

0

WBWiktoria Blomgren Strandbergpentesting-dvwa.hashnode.devMar 8 · 14 min read

Authorisation Bypass in DVWA

1 Introduction In this post, the Authorisation Bypass vulnerability in the Damn Vulnerable Web Application (DVWA) is described. The objective for attacks on all levels is to identify any areas where a

0

AKAnkit Kumarkubesimplify.hashnode.devJan 17 · 7 min read

Exploiting Metasploitable2 Using msfconsole (Kali Linux Lab)

Exploiting Metasploitable2 Using msfconsole (Kali Linux Lab) Introduction msfconsole is the heart of the Metasploit Framework and one of the most powerful tools used by penetration testers to identify, exploit, and validate security vulnerabilities. ...

0

NSNull Sirynctfs.hashnode.devJan 1 · 4 min read

Multifactorial CTF Writeup: Bypassing MFA via WebAuthn Exploit

Challenge Description Category: Web exploitationAuthor: thee2d Modern authentication relies on more than just a password. Something you know, something you have, and something you are. Together, they're meant to provide layered security that can with...

0

#web-exploitation

Search Hashnode

#web-exploitation

Explore Hashnode

Trending tags this week

FAM CTF : The Cloud writeup

FAM CTF : The Vault Door Writeup

HackTheBox : Void Whispers Writeup

HackTheBox : Race Writeup

HackTheBox: NeoVault Challenge Writeup

HackTheBox: Watcher Writeup

Heart Part 7 — dalCTF 2026

Authorisation Bypass in DVWA

Exploiting Metasploitable2 Using msfconsole (Kali Linux Lab)

Multifactorial CTF Writeup: Bypassing MFA via WebAuthn Exploit