YPYogeshwar Peelainexploitnotes.hashnode.dev·6d ago · 7 min readBrunnerCTF - php-2003 WriteupSummary A "Brunnerne Hosting" customer portal exposed a legacy reservation import form that fed user-controlled, base64-encoded data into unserialize(). Getting a flag required chaining three independ01J
YPYogeshwar Peelainexploitnotes.hashnode.dev·6d ago · 8 min readBrunnerCTF : WordPressed to Root WriteupOverview The box ships a mostly-stock WordPress 7.0.0 install on PHP 8.2 / Apache, running on a Debian Trixie base image, packaged as a Docker/Kubernetes challenge deployment. Initial access comes thr00
YPYogeshwar Peelainexploitnotes.hashnode.dev·6d ago · 8 min readBrunnerCTF : Bink Ink WriteupSummary The challenge exposes a firmware update service ("Bink ink update tool v1.0.5") running as brunner_operator inside a Debian container, reachable only through a Squid proxy. The tool accepts te00
YPYogeshwar Peelainexploitnotes.hashnode.dev·6d ago · 3 min readBrunnerCTF 2026 - Welcome Aboard (Web)Summary The Brunnerne Inc. internal wiki sits behind layered infrastructure. Direct access to /wiki/internal/flag (hinted by robots.txt) returns a hard 403 Access is forbidden. from Kestrel. The platf00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 18 · 8 min readTryHackMe : Athena WriteupOverview Athena is an easy-rated TryHackMe box that chains a leaked internal path (found via an anonymous SMB share) into a command injection vulnerability in a "router panel" ping tool, followed by a00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 18 · 4 min readTryHackMe: Corridor - WriteupOverview Corridor is an easy TryHackMe box built around a single Flask/Werkzeug web app. The homepage presents an image of a corridor with thirteen clickable doors, each linking to a URL that is an MD00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 12 · 7 min readTryHackMe : Lookup writeupSummary Lookup is an easy Linux box built around a login portal that redirects authenticated users to a vhost-hosted elFinder file manager. Username enumeration on the login form combined with passwor11N
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 10 · 35 min readTryHackMe : Overflow The Jackpot writeup# Challenge Category Flag 1 B1t Recovery Crypto THM{[REDACTED]} 2 Lost Fortune Included Web THM{REDACTED} 3 Casino Heist Forensics THM{REDACTED} 4 Fresh Powder - Bonus Challenge Detection Eng10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 11 · 18 min readTryHackMe : The London Bridge writeupSummary The London Bridge is built around a Flask "Explore London" gallery app served behind Gunicorn. A hidden /view_image endpoint takes a form-encoded URL and fetches it server-side - classic SSRF 11N
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 7 · 11 min readTryHackMe : Infinity Pool WriteupSummary Recon on <MACHINE_IP> revealed a Gunicorn-hosted "Byte Lotus" hotel site with two paths disallowed in robots.txt - /internal/ and /status. The /status page exposes an internal staff tool ("Sis21N
