Cascade write-up (HackTheBox): Windows media machine that exploits LDAP to enumerate users and hidden attributes, obtains VNC credentials from log, reverses .NET binary for AES key, and recovers admin password from deleted objects in Active Directory Recycle Bin.
Explanation of how to exploit a JWT vulnerability by changing the algorithm (RS256 → HS256) and using the public key as the secret. PoC based on the Moar Horse 4 challenge from TJCTF 2020.
Practical summary of port forwarding/tunnelling techniques in Linux and Windows (SSH, socat, netcat, meterpreter, plink, and netsh) for accessing internal services behind firewalls.
Proof of Concept (PoC) for the WinRAR CVE-2018-20250 vulnerability, allowing remote code execution by extracting malicious files to arbitrary directories. Step-by-step guide to create a malicious ACE file that executes a payload on system startup.
Practical compilation of methods for transferring files during post-exploitation on Linux and Windows. Includes HTTP, Netcat, SCP, FTP, SMB, Certutil, PowerShell, and Powercat. Ideal for uploading tools or downloading data from the victim without Meterpreter or Empire.
Compilation of techniques for obtaining shell access in Windows after RCE. Includes in-memory PowerShell, Powercat, Regsvr32, HTA, Cscript, MSBuild, WMIC, Certutil, and tests against Windows Defender.
Practical guide to generating a malicious PDF that, when opened in Windows, forces NTLM authentication and captures the NET-NTLMv2 hash. Includes generation with modern tools, cracking with hashcat, and use of psexec. Updated with best practices and current alternatives.
Complete guide to XSS vulnerabilities: types (Reflected, Stored, DOM-Based), filter bypass techniques, and payloads to evade validations and WAFs.
Practical guide to creating a fake WiFi access point (Evil Twin / FakeAP) with Wifiphisher. We clone a hotel captive portal, deauthenticate users, and steal credentials. Updated with modern tools and ethical recommendations.
Canape write-up (HackTheBox). Intermediate Linux machine that exploits an insecure pickle deserialisation in Flask + CouchDB. Includes RCE via pickle payload, CouchDB enumeration, and escalation to root by abusing sudo pip install.