Complete activity history — writeups and projects sorted by newest first.
Compromised LooseEnds through Vvveb CMS 1.0.5 by decoding exposed administrator credentials, exploiting CVE-2025-8518 …
Compromised the Overpass machine by bypassing the administrator authentication through an improperly validated …
Compromised the Pickle Rick machine by discovering a username in the website source code, recovering the password from …
Compromised the RootMe machine by discovering the hidden /panel/ directory, bypassing the PHP upload restriction with a …
Compromised the Billing machine by exploiting MagnusBilling through CVE-2023-30258 to obtain an unauthenticated remote …
Compromised the CraftFall machine by exploiting Craft CMS 5.6.16 through CVE-2025-32432 to obtain a www-data shell, …
Compromised the Kyubi machine by exploiting Grafana CVE-2021-43798 to read local files and recover a Redis password, …
Compromised TheDoor by abusing anonymous FTP to obtain an information-disclosing email, discovering hidden numbered web …
Compromised the Real machine by exploiting the UnrealIRCd 3.2.8.1 backdoor to obtain a server shell, discovering a root …
Compromised the Safeguard machine by exploiting Apache Tomcat 10.1.34 through CVE-2025-24813 to obtain a tomcat shell, …
Compromised the Alpine machine by discovering exposed SSH credentials, gaining access as developer, recovering a …
Compromised the Cibercamp machine by exploiting WP File Manager 6.0 for unauthenticated RCE, obtaining a reverse shell …
Compromised the Vvveb machine by identifying Vvveb CMS 1.0.5, discovering the exposed /system/secret endpoint and …
Compromised the ZeroTrace machine by discovering a hidden .admin directory and exploiting LFI to enumerate /proc …
Compromised the Trace machine by enumerating an exposed NFS share, discovering internal domains, bypassing a PHP …
Compromised the NorthWing machine by exploiting Local File Inclusion with a PHP filter wrapper, recovering and cracking …
Compromised the Blind machine by exploiting command injection in the DNSRecon GUI, obtaining a reverse shell as …
Compromised the WellPlayed machine through unauthenticated WordPress WP2Shell RCE, obtained credentials from a sensitive …
Compromised the VisionLab machine by abusing an insecure PyTorch model upload, executing a malicious serialized payload …
Compromised the University machine by abusing password reset information disclosure, obtaining default Moodle …
Compromised the Explorer machine by discovering eXtplorer through robots.txt, authenticating with default credentials, …
A Volt walkthrough demonstrating access-control bypass, admin credential brute-forcing, command injection, credential …
Compromised the Open machine by abusing default OpenPLC credentials, recovering a valid ttyd username, brute-forcing the …
Compromised the Care machine by exploiting a Local File Inclusion vulnerability to poison Squid proxy logs and achieve …
Compromised the Lookup machine by abusing an unrestricted DNS Zone Transfer to enumerate employee accounts, reused the …
Compromised the Startup machine by abusing an anonymous writable FTP share to upload a PHP web shell, recovered SSH …
Exploited the Ghostcat vulnerability to read Tomcat configuration files, recovered SSH credentials, cracked a GPG …
Exploited a vulnerable WebDAV configuration to upload a PHP web shell, gained remote code execution, and escalated …
Exploited a command injection vulnerability in a custom network utility to obtain a reverse shell, then escalated …
Abused HTTP PUT and MOVE methods to upload and execute a PHP web shell, gained initial access as www-data, and escalated …
Enumerated an exposed iSCSI target, recovered deleted files using PhotoRec, extracted administrative credentials from a …
Enumerated web directories, extracted Borg archives, recovered credentials, and exploited sudo permissions for root …
Discovered hidden web directories, recovered FTP credentials, extracted SSH credentials from steganographic content, and …
Covers source code disclosure, directory discovery, cookie tampering, LFI, encoding, and command injection.
Redis enumeration and flag retrieval through unauthenticated access.
User-controlled search input is reflected without sanitization, allowing arbitrary JavaScript execution.
Exploited anonymous SMB access, leaked JWT credentials, bypassed file upload restrictions for RCE, recovered KeePass …
Exploited LFI to retrieve an encrypted SSH key, cracked its passphrase, gained SSH access, and escalated privileges via …
Identified a vulnerable Windows 7 host, confirmed MS17-010, exploited EternalBlue using Metasploit, and obtained NT …
Enumerated users through the Finger service, obtained SSH access with weak credentials, and escalated privileges via a …
Recovered FTP credentials from a leaked username, uploaded a Node.js reverse shell, obtained access as a low-privileged …
Enumerated a Redis instance, recovered stored credentials, gained SSH access, and abused a misconfigured gdb capability …
Exploited an LFI vulnerability to poison Apache logs, gained a reverse shell, abused sudo permissions, cracked a GPG …
Mounted an exposed NFS share, uploaded a PHP reverse shell, gained initial access, and escalated privileges through a …
Enumerated a valid user using the Ident protocol, brute-forced SSH credentials, and abused sudo access to multitail to …
Enumerated services, identified a username from an SSH banner, brute-forced Telnet credentials, and gained root by …
Discovered a hidden virtual host, generated custom passwords using CeWL, obtained SSH access through weak credentials, …
A cybersecurity research project exploring keyboard event monitoring, HTTP communication, and centralized logging using …
A responsive client-side security tool that generates hashes using MD5, SHA-1, SHA-2, SHA-3, and BLAKE2 algorithms while …
A collection of planned security tools including recon automation, payload generators, and lab utilities.
Database application for managing student records with search, filter, and export capabilities.