03
Aug
Hacker Mystery Box #003: The Unlit City Hero Roll — A Night Seal Was Never a Pass (Custom Machine)
13 min read
03
Aug
Hacker Blind Box #002: Night Letter from the Listening Rain Inn — The Rain Gate Believed the First Lie
10 min read
03
Aug
Hacker Blind Box #001: Yunhai Sword Sect — Claiming the Grandmaster's Secret Teachings (Custom Vulnerable Machine)
9 min read
30
Jul
TryHackMe Watcher Walkthrough: Variations on a Writable File
8 min read
17
Jul
Generic University — OWASP API Security Top 10 Lab Writeup
12 min read
16
Jul
MBPTL: Full Penetration Testing Lab Writeup (17 Flags)
17 min read
13
Jul
ThreadHub Lab: Chaining Secondary-Context Path Traversal and DNS Rebinding into SSRF
10 min read
12
Jul
PhantomShop (PhantomRange) Writeup Part 1 — Recon, Info Disclosure & Broken Auth
6 min read
12
Jul
VulNyx Brain Walkthrough: LFI to Root via /proc/sched_debug
6 min read
11
Jul
DockerLabs redirection Writeup: Open Redirect to Root
7 min read
11
Jul
After the Legend: A Complete Map of Modern Pentest Lab Platforms Beyond VulnHub (2026)
3 min read
11
Jul
Node: 1 Full Walkthrough — From AngularJS API Leak All the Way to PwnKit
7 min read
11
Jul
Temple of Doom: 1 Full Walkthrough — From Environment Hell to PwnKit
9 min read
10
Jul
GoldenEye: 1 — Full Walkthrough: Rooting a VulnHub Box from the Command Line When the Tools Won't Cooperate
12 min read
10
Jul
Damn Vulnerable RESTaurant: The Full API Attack Chain from Anonymous Visitor to In-Container RCE
15 min read
10
Jul
Beyond Juice Shop: Broken Crystals and the "Diamond Labs" I've Been Collecting
9 min read
04
Jul
Hands-On with OAuth Labs (Part 1): Exploiting Unstable Claims in Lab 01
7 min read
03
Jul
Broken Crystals Field Notes 4: MCP Attack — Full Kill Chain from Unauthenticated Guest to admin Privilege-Escalation RCE
7 min read
03
Jul
Broken Crystals Field Notes 3: eval SSJI to root RCE, and an XXE That Reads Files but Can't Do SSRF
5 min read
03
Jul
Broken Crystals Field Notes 2: From a Single Query Parameter to a Root Reverse Shell
5 min read
03
Jul
Broken Crystals Field Notes 1: From Information Disclosure to Arbitrary File Read (LFI)
6 min read
10
Nov
Chill Hack Walkthrough (TryHackMe): Command Injection to Root via Docker
6 min read
31
Oct
TryHackMe Mr. Robot Writeup: WordPress RCE to Root
3 min read
26
Oct
TryHackMe Network Services 2 (SMTP) Writeup
2 min read
26
Oct
TryHackMe Network Services 2 (MySQL) Writeup
4 min read
26
Oct
TryHackMe Network Services 1 (SMB) Writeup
1 min read
25
Oct
TryHackMe Security Footage Writeup: Recovering MJPEG Camera Footage from a PCAP
5 min read
25
Oct
TryHackMe - Intro to IoT Pentesting Writeup
7 min read
16
Oct
TryHackMe Publisher Writeup: SPIP RCE & AppArmor Bypass
4 min read
16
Oct
TryHackMe Lookup Writeup: Username Enumeration to Root
6 min read
07
Oct
TryHackMe DNS Manipulation Walkthrough: DNS Data Exfiltration
3 min read
06
Sep
VulnHub Investigator: 1 Writeup — ADB Root, SQLite SMS and Cracking the SSH Key
5 min read
06
Sep
VulnHub The Planets: Earth Writeup
9 min read