Offensive Security Research Notes
Hands-on offensive security research focused on Active Directory, web exploitation, privilege escalation, attack methodologies, bug bounty workflows, and practical lab-based learning.
Research Areas
Offensive Security Research
Active Directory tradecraft, Windows internals, privilege escalation, enumeration workflows, and practical offensive methodologies.
Explore ResearchBug Bounty & Web Exploitation
Reconnaissance workflows, web exploitation, authentication flaws, attack chains, and practical real-world methodologies.
Explore Bug BountyLabs & Walkthroughs
Hack The Box, TryHackMe, OffSec, HackeR DNA, and VulnHub walkthroughs focused on methodology, enumeration, and exploitation workflows.
Explore LabsLatest Technical Notes
PHP2Shell: How Two Bugs in PHP Core Became Pre-Auth RCE
CVE-2026-109618 and CVE-2026-109619 turn interrupted PHP request cleanup into unauthenticated remote code execution. Here is how the PHP2Shell chain works, what is affected, how to detect it, and why patching is the only complete fix.
Read ArticleeMudhra's Weak CA Keys: How Eight Bits Broke WebPKI Trust
Eight eMudhra intermediate CA keys were generated with one-byte private scalars. This is how the compromise happened, why browsers blocked the certificates within hours, and why the rest of your trust stores are still the problem.
Read ArticleQuery Quake
CTF writeup for NexaTech Solutions: bypassing a login with a UNION-based MySQL injection, turning it into RCE by writing a PHP webshell with INTO OUTFILE to grab the user flag, then escalating to root by overwriting a world-writable supervisord.cron script that cron runs as root to read the root flag.
Read ArticleSSRF Attack - Steal Cloud Metadata Credentials
CTF writeup exploiting a server-side request forgery in a link preview service to reach the AWS instance metadata endpoint, retrieve IAM credentials, and use them to read the root flag from an internal control-plane API.
Read ArticleSQL Injection Test - SQLite Login Bypass with Tautology Payload
CTF writeup bypassing the SQL Injection Test Lab login with an OR 1=1 limit 1 payload against a real SQLite backend to retrieve the flag.
Read ArticleReverse Engineering - License Key Crackme
CTF writeup static-analyzing an ARM64 aarch64 license activation client, XOR-decoding an embedded encrypted flag from g_token_enc, reverse-engineering derive_key to forge the admin license, and activating an admin account to receive the root flag.
Read ArticlePing Pwn - Command Injection into Network Monitoring Tool
CTF writeup exploiting unauthenticated OS command injection in the ping parameter of a Flask Network Monitoring Tool to read the flag as root.
Read ArticlePath Traversal - Apache 2.4.49 CVE-2021-41773 & LFI in CGI File Viewer
CTF writeup exploiting path traversal in an Apache 2.4.49 CGI file viewer to read flag.txt outside the web root via dot-dot-slash traversal.
Read ArticlePassword Cracking - Custom Wordlist - OSINT to MD5 to Portal to ZIP
CTF writeup building a custom wordlist from a game studio's own website to crack unsalted MD5 hashes from a leaked forum export, using password reuse to reach the internal portal and a protected vault.zip, then zip2john to open the final archive.
Read ArticleMythos Leak - Headless CMS Draft Exposure
CTF writeup exploiting a Sanity headless CMS mock: retrieving unpublished draft posts via GROQ, mining the document transaction log for a deleted briefing, recovering its historical revision with an embedded API token, and using the token to access a separate internal dataset that leaks a launch briefing containing the root flag.
Read ArticleLog Hunter - Web Log Forensics to Recover Stolen Backup
CTF writeup analyzing Apache access logs to identify a successful scanner probe that exfiltrated a backup.txt containing the flag, then accessing the recovered file.
Read ArticleInfiltrator - JWT Secret Cracking to Admin Panel to Root
CTF writeup cracking an HS256 JWT secret from rockyou to forge an admin token, leaking SSH credentials from the admin page, then escalating to root by injecting commands into a world-writable log file that a cron job evals.
Read ArticleHost Hijack
CTF writeup for MediTrack Health: exploiting a Host header vulnerability in the password reset flow to take over the admin account, leaking the full reset token from an exposed mail-log by shortening the Host header, then achieving root via a misconfigured NOPASSWD sudo find in a ping-tool command injection.
Read ArticleHack This Site - Client-Side Credential & Obscured Flag Extraction
CTF writeup defeating a SecureVault access control system whose credentials and flag are hardcoded in obfuscated client-side JavaScript, reversed with byte decoding.
Read ArticleAuth Bypass - SQL Injection Login Bypass on Express
CTF writeup bypassing the Enterprise Authentication System login with a classic SQL injection OR 1=1 payload to authenticate as admin on an Express-based auth service.
Read ArticlePickle Jar - Python Pickle Deserialization to Sudo RCE
CTF writeup exploiting Python pickle deserialization vulnerability in a Flask app to achieve RCE, then escalating privileges via a sudo-allowed backup script.
Read ArticleHidden CMS Breach - GetSimple Unauthenticated Leak to RCE
CTF writeup exploiting a GetSimple CMS 3.3.16 info disclosure to extract admin credentials, then RCE via theme editor webshell and privesc with sudo find.
Read ArticleCompromised 1 - Tomcat Default Credentials to WAR Deploy RCE
CTF writeup exploiting default admin:admin credentials on Apache Tomcat 9.0.96 Manager to deploy a WAR file for RCE, then privesc via sudo find.
Read ArticleAlpwned - SQLi to Werkzeug Debugger RCE on Alpine Linux
CTF writeup exploiting SQL injection in a Flask app to reach an admin dashboard, then using the Werkzeug debugger console for root RCE.
Read ArticleTraversed HackerDNA CTF - Git Exposed & Module Hijacking
CTF writeup exploiting an exposed .git directory to recover leaked SSH credentials, then privesc via Python module hijacking with sudo.
Read ArticleAlVault HackerDNA CTF - Command Injection & Hidden Endpoints
AlVault CTF writeup — exploiting a hidden grep-based search tool to extract SSH credentials, then privesc via os.system() command injection.
Read ArticleOSCP Commands – Obsidian Notes for Real Exam Execution
A clean, structured Obsidian vault with OSCP commands organized for real exam execution. Save hours during labs and exam with instant command recall.
Read ArticleOSWP Notes – Practical Wireless Attacks, Simplified
A clean, structured guide to wireless penetration testing. OSWP exam-ready commands and workflows for reliable attack execution.
Read ArticleWeb Security Checklist – Real Bug Hunting, Systematically
A systematic web security checklist for bug bounty hunters. Find more valid bugs with structured testing — not random guessing.
Read ArticleCRTA Notes – Real-World Active Directory Red Team Playbook
A complete Active Directory red team playbook for CRTA certification. Real-world attacks, privilege escalation, and domain dominance strategies.
Read ArticleVulnUniversity - TryHackMe Walkthrough
TryHackMe VulnUniversity walkthrough — exploiting a file upload vulnerability to get a reverse shell, then escalating privileges using SUID binaries on Linux.
Read ArticleTutorial - TryHackMe room Writeup
TryHackMe Tutorial room walkthrough — beginner-friendly introduction to web enumeration, privilege escalation, and basic penetration testing methodology.
Read ArticleThe Impossible Challenge - TryHackMe room Writeup
TryHackMe Impossible Challenge walkthrough — steganography techniques to hidden data in images and extract flags using command-line tools.
Read ArticleOwasp Top 10 - TryHackMe room to learn OWASP Top 10 2021
TryHackMe OWASP Top 10 walkthrough — hands-on exercises covering injection, broken authentication, XSS, IDOR, SSRF, and other critical web vulnerabilities.
Read ArticleOverpass 2 - Hacked | TryHackMe Walkthrough
TryHackMe Overpass 2 walkthrough — analyzing a pcap capture to find a backdoor SSH connection, then privilege escalation via a custom setuid binary.
Read ArticleDaily Bugle - TryHackMe room writeup
TryHackMe Daily Bugle walkthrough — exploiting a vulnerable Joomla instance with Metasploit and cracking a root password with John the Ripper.
Read Articleffuf - TryHackMe Directory Busting Writeup
TryHackMe ffuf room walkthrough — learning web fuzzing and directory brute-forcing with ffuf, including filtering, matching, and recursive discovery techniques.
Read ArticleKenobi - TryHackMe Walkthrough (Samba, ProFTPd, Privesc)
TryHackMe Kenobi walkthrough — enumerating Samba shares, exploiting ProFTPd with searchsploit, and privilege escalation via SUID path variable manipulation.
Read ArticleFristiLeaks 1.3 - VulnHub Walkthrough (nmap, dirb, netcat)
VulnHub FristiLeaks 1.3 walkthrough — web enumeration with dirb, exploiting a command injection vulnerability, and privilege escalation to root.
Read ArticleHackLAB Vulnix - VulnHub Sudo Privilege Escalation
VulnHub HackLAB Vulnix walkthrough — exploiting sudo misconfigurations and Linux privilege escalation techniques to gain root on a vulnerable machine.
Read ArticleEscalate My Privileges 1 Vulnhub Machine solved manually
VulnHub Escalate My Privileges 1 walkthrough — manual enumeration, exploitation, and privilege escalation without using automated tools.
Read ArticleKioptrix Level 1.2 - LotusCMS RCE
VulnHub Kioptrix 1.2 walkthrough — exploiting LotusCMS remote code execution and privilege escalation via the ht editor to gain root access.
Read ArticleCrackTheHash Writeup - TryHackMe room to learn hash cracking
TryHackMe CrackTheHash walkthrough — identifying hash types and cracking MD5, SHA1, NTLM, and bcrypt hashes using hashcat and online tools.
Read ArticleBlue - TryHackMe Room Solved Using EternalBlue
TryHackMe Blue walkthrough — exploiting EternalBlue MS17-010 with Metasploit to gain SYSTEM shell, then harvesting hashes with Mimikatz.
Read ArticleAttacktive Directory - TryHackMe Active Directory Lab
TryHackMe Attacktive Directory walkthrough — Kerbrute enumeration, AS-REP Roasting, Kerberoasting, and DCSync to compromise an AD domain.
Read ArticleAuthBy - Offsec PG Intermediate Windows Writeup
OffSec Proving Grounds AuthBy walkthrough — Windows enumeration, credential harvesting, and lateral movement on an Intermediate-rated machine.
Read ArticleAlgernon - Offsec PG Easy Windows Writeup
OffSec Proving Grounds Algernon walkthrough — exploiting Windows service misconfigurations for initial access and privilege escalation on an Easy-rated machine.
Read ArticleImaginary CTF 2023 WriteUps
Imaginary CTF 2023 competition writeups — solutions for web exploitation, cryptography, and reverse engineering challenges from this CTF event.
Read ArticleLame - HackTheBox Easy Linux Machine
HackTheBox Lame walkthrough — exploiting Samba 3.0.20 with Metasploit for instant root shell on a vulnerable Linux machine.
Read ArticleDevel - HackTheBox Easy Windows via Anonymous FTP RCE
HackTheBox Devel walkthrough — gaining initial access through anonymous FTP upload and achieving privilege escalation via MS11-046 on a Windows 7 box.
Read ArticleLegacy - HackTheBox Easy Windows Machine via Metasploit
Quick HackTheBox Legacy walkthrough — exploiting MS08-067 with Metasploit to get root on an unpatched Windows XP machine in under 5 minutes.
Read ArticlePopcorn - HackTheBox Medium Linux Machine Walkthrough
HackTheBox Popcorn walkthrough — intercepting a torrent upload with Burp Suite to drop a PHP webshell, then escalating to root on a Medium Linux machine.
Read ArticleJust 5 Minutes to My 2nd Stored XSS on Edmodo.com
How I found my second stored XSS on Edmodo.com in just five minutes by testing notification systems — payload crafting, disclosure timeline, and key takeaways for bug hunters.
Read ArticleMy First Stored XSS on Edmodo.com - Hunting Methodology
How I found my first stored XSS vulnerability on Edmodo.com using manual testing and subdomain enumeration. A beginner's journey to bug bounty.
Read Article