--- title: "#writeup articles | Hashnode" description: "Explore 92 articles tagged #writeup on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/writeup" --- Tag # #writeup 92 posts · 11 followers [Anirudh](https://hashnode.com/@redtrib3) · [Nov 3](https://hashnode.com/posts/smarthire-hackthebox-writeup/6aea22dca01113fbb564430e) ### [SmartHire - hackthebox writeup](https://blog.redtrib3.in/smarthire-hackthebox-writeup?utm_source=hashnode&utm_medium=feed) Introduction Smarthire is a medium rated machine in hackthebox released off-season. This is the first box I submitted to hackthebox and was approved. I expected it to be approved as an easy box, but h 11 min read · [blog.redtrib3.in](https://blog.redtrib3.in/smarthire-hackthebox-writeup?utm_source=hashnode&utm_medium=feed) [Cannon bolt](https://hashnode.com/@jetray) · [Nov 2](https://hashnode.com/posts/tryhackme-seetwo/6ae874166643d2de86c45919) ### [TryHackMe - SeeTwo](https://jetray.hashnode.dev/tryhackme-seetwo?utm_source=hashnode&utm_medium=feed) In this task, we have to step into the digital forensics analyst's shoes and investigate the incident. Let's start our investigation by downloading the evidence.zip file. Unzipping it yields a .pcap f 5 min read · [jetray.hashnode.dev](https://jetray.hashnode.dev/tryhackme-seetwo?utm_source=hashnode&utm_medium=feed) [Nano](https://hashnode.com/@0xNano) · [Oct 26](https://hashnode.com/posts/forest-writeup/6adeddb917055badcbe8491d) ### [Forest WriteUp](https://blog.0xnano.com/forest-writeup?utm_source=hashnode&utm_medium=feed) HTB Forest writeup: ASREPRoasting, BloodHound enumeration, and Exchange Windows Permissions abuse to achieve DCSync and Domain Admin. 4 min read · [blog.0xnano.com](https://blog.0xnano.com/forest-writeup?utm_source=hashnode&utm_medium=feed) [Abdulaziz Saad](https://hashnode.com/@b4zb0z) · [Aug 18](https://hashnode.com/posts/the-1000-ticket-idor-one-number-exposed-national-ids-and-government-staff-pii/6a84981a420d939a0d95077d) ### [The $1000 Ticket IDOR: One Number Exposed National IDs and Government Staff PII](https://blog.abdulaziz-d.com/the-1000-ticket-idor-one-number-exposed-national-ids-and-government-staff-pii?utm_source=hashnode&utm_medium=feed) Severity: HighBounty: ~$949Program: Private Bug BountyPlatform: Bugbounty.sa This finding started with a very simple endpoint: GET /api/tickets-management/portal/history-by-ticket/ The end 10 min read · [blog.abdulaziz-d.com](https://blog.abdulaziz-d.com/the-1000-ticket-idor-one-number-exposed-national-ids-and-government-staff-pii?utm_source=hashnode&utm_medium=feed) [Abdulaziz Saad](https://hashnode.com/@b4zb0z) · [Aug 17](https://hashnode.com/posts/from-editor-to-owner-one-writable-field-was-enough-to-take-over-an-organization/6a831cf43bcdcbef0d27359d) ### [From Editor to Owner: One Writable Field Was Enough to Take Over an Organization](https://blog.abdulaziz-d.com/from-editor-to-owner-one-writable-field-was-enough-to-take-over-an-organization?utm_source=hashnode&utm_medium=feed) Severity: HighBounty: ~$315Platform: Standoff365 This one came down to a single field that should never have been writable by an editor: Firm\[user\_id\] The application had a clear permission model. An 12 min read · [blog.abdulaziz-d.com](https://blog.abdulaziz-d.com/from-editor-to-owner-one-writable-field-was-enough-to-take-over-an-organization?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 6](https://hashnode.com/posts/tryhackme-the-hollow-shell/6a7498ba00123b08dc0336bf) ### [TryHackMe : The Hollow Shell](https://exploitnotes.hashnode.dev/tryhackme-the-hollow-shell?utm_source=hashnode&utm_medium=feed) Complete TryHackMe Hollow Shell walkthrough exploiting Zip Slip and unsafe hooks for RCE, gaining roomservice access and capturing the flag! Steps 5 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-the-hollow-shell?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 4](https://hashnode.com/posts/tryhackme-cryptocabana-writeup/6a721589ad7930de76f4c240) ### [TryHackMe : CryptoCabana Writeup](https://exploitnotes.hashnode.dev/tryhackme-cryptocabana-writeup?utm_source=hashnode&utm_medium=feed) Complete TryHackMe CryptoCabana walkthrough exploiting SAS token leaks, Key Vault secret versioning, and Service Principal exposure to recover flag. 7 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-cryptocabana-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 4](https://hashnode.com/posts/tryhackme-towel-on-the-sunbed-writeup/6a71f33420b4883bd91e12d1) ### [TryHackMe : Towel on the Sunbed Writeup](https://exploitnotes.hashnode.dev/tryhackme-towel-on-the-sunbed-writeup?utm_source=hashnode&utm_medium=feed) Complete Towel on the Sunbed THM walkthrough covering race conditions, TOCTOU exploitation, concurrent requests, and vault flag recovery. 6 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-towel-on-the-sunbed-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 4](https://hashnode.com/posts/tryhackme-beach-bar-writeup/6a7166c034de950fe31a3bdb) ### [TryHackMe : Beach Bar Writeup](https://exploitnotes.hashnode.dev/tryhackme-beach-bar-writeup?utm_source=hashnode&utm_medium=feed) Complete Beach Bar THM walkthrough covering Flask YAML deserialization, RCE, privilege escalation, and full root compromise. 7 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-beach-bar-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 4](https://hashnode.com/posts/tryhackme-overheard-at-breakfast/6a716d9dba96c430fd96ed91) ### [TryHackMe : Overheard at Breakfast](https://exploitnotes.hashnode.dev/tryhackme-overheard-at-breakfast?utm_source=hashnode&utm_medium=feed) Complete Overheard at Breakfast THM walkthrough covering OSINT, Gravatar profile lookup, email hashing, Base64 decoding, and flag recovery. 5 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-overheard-at-breakfast?utm_source=hashnode&utm_medium=feed)