HackerDNA
HackerDNA
HackerDNA CTF walkthroughs covering web exploitation, privilege escalation, and practical capture-the-flag methodology.
hackerdna
Pickle Jar - Python Pickle Deserialization to Sudo RCE
CTF writeup exploiting Python pickle deserialization vulnerability in a Flask app to achieve RCE, then escalating privileges via a sudo-allowed backup script.
Read Article
hackerdna
Hidden CMS Breach - GetSimple Unauthenticated Leak to RCE
CTF writeup exploiting a GetSimple CMS 3.3.16 info disclosure to extract admin credentials, then RCE via theme editor webshell and privesc with sudo find.
Read Article
hackerdna
Compromised 1 - Tomcat Default Credentials to WAR Deploy RCE
CTF writeup exploiting default admin:admin credentials on Apache Tomcat 9.0.96 Manager to deploy a WAR file for RCE, then privesc via sudo find.
Read Article
hackerdna
Alpwned - SQLi to Werkzeug Debugger RCE on Alpine Linux
CTF writeup exploiting SQL injection in a Flask app to reach an admin dashboard, then using the Werkzeug debugger console for root RCE.
Read Article
hackerdna
Traversed HackerDNA CTF - Git Exposed & Module Hijacking
CTF writeup exploiting an exposed .git directory to recover leaked SSH credentials, then privesc via Python module hijacking with sudo.
Read Article
hackerdna
AlVault HackerDNA CTF - Command Injection & Hidden Endpoints
AlVault CTF writeup — exploiting a hidden grep-based search tool to extract SSH credentials, then privesc via os.system() command injection.
Read Article