Security Writeups

Documented walkthroughs of the labs, rooms, and challenges I complete as I learn offensive security. Each writeup covers what I did, what I learned, and how I'd apply it in a real engagement.

All work is performed in authorized, legal environments only — practice platforms, labs, and in-scope programs.

Challenges & CTFs

End-to-end engagements against a target — reconnaissance through to full compromise, chaining multiple vulnerabilities.

• AD Delegation Abuse — SMB enumeration to Domain Admin via NTLM coercion, BloodHound pathfinding, and Kerberos constrained delegation (S4U2Self/S4U2Proxy) abuse
• AD RBCD Abuse — KeePass credential extraction, password spraying, and Resource-Based Constrained Delegation abuse to Domain Admin
• Web-to-Root Chain — hardcoded key recovery, broken password reset, IDOR, JWT secret forgery, stored XSS, RFI-to-RCE, and cronjob privesc to root
• SQLi to Root — SQL injection auth bypass, command injection via newline smuggling, and an offline KeePass crack to recover root
• Node App to Domain Admin — SQLi to Node.js RCE, credentials leaked via a decompiled APK reused on the domain, escalating to Domain Admin via direct AddMember abuse
• SQLi to Root — SQLi, admin-panel enumeration, command injection, pattern-based password recovery after getting stuck, and sudo/GTFOBins privesc to root
• OTP Bypass to RCE — backup file disclosure, an OTP verification logic flaw (renaming the field, not guessing the code), and command injection with filter evasion
• SSRF to Root — anonymous FTP source disclosure, SSRF via URL-validation bypass, and Tar Wildcard Injection for root
• File Disclosure → SQL Injection Chain — leaked app source via a file-read flaw to gain a foothold, then used UNION-based SQLi to recover admin credentials and take over the portal
• Support Operations Platform — a five-stage chain from weak-password foothold to command-injection RCE
• Linux PrivEsc Chain — lateral movement through five users to root via cron poisoning, PATH hijack, sudo helper abuse, and a GTFOBins less escape
• Windows PrivEsc Chain — escalating from anonymous SMB access to SYSTEM via a service-binary hijack, a registry AutoLogon credential, and a writable SYSTEM scheduled task

Reconnaissance & Tooling

• Network Reconnaissance — passive vs active recon, common protocols, and why encrypted protocols (TLS, SSH) defend against sniffing and MITM
• Nmap — host discovery, basic and advanced port scanning, and service/OS fingerprinting
• Burp Suite — using Burp for intercepting and modifying web requests, plus credential attacks and macros

Web Application Vulnerabilities

• SQL Injection — exploiting error-based and UNION-based SQLi, enumerating databases via information_schema
• Cross-Site Scripting (XSS) — crafting context-specific XSS payloads, bypassing filters, and escalating from alert() to cookie theft
• Cross-Site Request Forgery (CSRF) — exploiting missing and weak (base64-encoded) CSRF tokens to take over accounts and escalate privileges
• Server-Side Request Forgery (SSRF) — bypassing a deny-list defense with a path-traversal trick to reach a restricted internal endpoint
• Insecure Direct Object Reference (IDOR) — exploiting a missing authorization check on an API endpoint to access other users' profiles
• File Inclusion — path traversal and LFI with null-byte injection, plus RFI escalated to remote code execution
• Command Injection — verbose and blind OS command injection, shell operators, and time-based detection
• API Pentesting — BOLA, JWT attacks (weak secrets, none-algorithm), excessive data exposure, and mass assignment
• Broken Authentication — username enumeration, brute force, a password-reset hijack via HTTP Parameter Pollution, and cookie manipulation
• Session Management — session lifecycle, the IAAA model, and the opposite CSRF/XSS weaknesses of cookie vs token sessions