Hackpuntes

RedTeam Command Generator

Mon, 01 Jan 0001 00:00:00 +0000

Like revshells.com / WADComs , but for Active Directory and red teaming. Enter the target details once and every command below fills itself in — no more rewriting IPs, domains or hashes for each tool. Use the search box to filter by technique or tool.

OWASP Risk Assessment Calculator

Mon, 01 Jan 0001 00:00:00 +0000

Score the risk of a vulnerability following the OWASP Risk Rating Methodology . Tune the 16 factors (threat agent, vulnerability, technical and business impact) and instantly get the likelihood, impact and overall severity, with its radar chart. The vector is stored in the URL — copy the link to share or document the assessment.

CVSS 4.0 Calculator

Mon, 01 Jan 0001 00:00:00 +0000

Score a vulnerability’s severity with CVSS v4.0 using FIRST.org ’s official scoring engine (same result as the official calculator). Tune the Base, Threat, Environmental and Supplemental metrics — each one explained — and instantly get the score, severity and the vector, stored in the URL to share or document the assessment.

Logging WriteUp

Sat, 18 Jul 2026 00:00:00 +0000

Logging is a 🟧 Medium difficulty machine on Hack The Box, and it is one of those Active Directory boxes where you keep chaining one flaw after another until you own the whole domain. We start by reading a plaintext password someone left lying around in a log, we abuse permissions over a gMSA account to grab its hash, we jump to another user with a DLL hijacking in a scheduled task, and to finish we request an ADCS certificate via ESC1 and impersonate a WSUS server to run code as SYSTEM on the Domain Controller. It sounds like a lot, but we are going to take it slow and go bit by bit.

CCTV WriteUp

Sat, 11 Jul 2026 00:00:00 +0000

CCTV is a 🟩 Easy machine on Hack The Box. It chains a SQL Injection in ZoneMinder to obtain SSH credentials, with the discovery of internal video surveillance services after pivoting from the compromised machine. Escalation to root is achieved through an authenticated RCE in motionEye.

IP: 10.129.3.35
Approximate time: ~1.5h

🗺️ Attack Chain

Nmap → Port 80 (ZoneMinder 1.37.63)
│
▼
Default credentials admin:admin → panel access
│
▼
CVE-2024-51482 (Boolean SQLi) → sqlmap → mark:opensesame
│
▼
SSH as mark
│
▼
LinPEAS → tcpdump (cap_net_raw) + internal ports
│
▼
Port Forwarding → motionEye 0.43.1b4 on :8765
│
▼
/etc/motioneye/motion.conf → admin:989c5a8ee87a0e9521ec81a79187d162109282f0
│
▼
CVE-2025-60787 (Metasploit RCE) → root 🏴

🔍 Reconnaissance

Port Scanning

echo "10.129.3.35 cctv.htb" | sudo tee -a /etc/hosts
sudo nmap -p- --open -Pn --min-rate 5000 -oA ports -vvv cctv.htb
grep -oP '\d+/open' ports.gnmap | cut -d'/' -f1 | sort -u | tr '\n' ',' | sed 's/,$//' > ports.txt
sudo nmap -sCV -p$(cat ports.txt) -Pn -oA scan -vvv cctv.htb

Port	Service	Detail
`22`	SSH	OpenSSH 9.6p1 Ubuntu
`80`	HTTP	Apache 2.4.58 → `SecureVision CCTV`

Small attack surface. Port 22 is not vulnerable, so we focus on port 80.

DevArea WriteUp

Sat, 04 Jul 2026 00:00:00 +0000

DevArea is a 🟧 Medium machine on Hack The Box, part of Season 10, created by EmSec. It simulates a development environment with multiple exposed services: a SOAP web service running on Apache CXF/Jetty, an FTP server with anonymous access, and a Hoverfly service virtualization platform. The path chains an arbitrary file read vulnerability with API abuse to gain initial access, then exploits a critical misconfiguration in the system’s bash binary to escalate to root.

WingData WriteUp

Sat, 27 Jun 2026 00:00:00 +0000

WingData is an 🟩 Easy difficulty machine on Hack The Box, Season 10, created by WackyH4cker. The attack chain combines exploiting a vulnerable Wing FTP Server for initial access, extracting and cracking credentials from configuration files, and privilege escalation through a vulnerability in Python’s tarfile module.

🗺️ Attack Chain

Reconnaissance → Port 80 + 22
│
▼
Web enumeration → ftp.wingdata.htb (Wing FTP Server v7.4.3)
│
▼
CVE-2025-47812 → Unauthenticated RCE → Shell as wingftp
│
▼
/opt/wftpserver/Data/1/users/wacky.xml → Salted SHA-256 hash
│
▼
Hashcat (mode 1410) → Plaintext password → SSH as wacky
│
▼
sudo -l → restore_backup_clients.py (root) → CVE-2025-4517
│
▼
Malicious tar → path traversal → /etc/sudoers → root 🏴

🔍 Reconnaissance

/etc/hosts Setup

Before we start, we add the machine IP to /etc/hosts so we can use the domain name across all tools:

NanoCorp WriteUp

Sat, 20 Jun 2026 00:00:00 +0000

NanoCorp is a 🟥 Hard difficulty machine from the Hack The Box platform. The attack chain starts at a job portal that accepts résumés in ZIP format: by packaging a malicious .library-ms file (CVE-2025-24071) we get the server, on extraction, to try to authenticate over SMB against our machine, leaking the NetNTLMv2 hash of a service account. After cracking that password, we use BloodHound to map the domain and discover a DACL abuse chain that lets us join a privileged group and reset the password of another service account with WinRM access. The final escalation exploits CVE-2024-0670 in the Checkmk monitoring agent, abusing the repair of its MSI installer to run our own script as NT AUTHORITY\SYSTEM.

VariaType WriteUp

Sat, 13 Jun 2026 00:00:00 +0000

VariaType is a 🟧 Medium difficulty machine on Hack The Box, Season 10. The attack chain starts by discovering an exposed Git repository on an internal portal, extracting credentials from the commit history, exploiting an arbitrary file write in fontTools to get a shell, moving laterally by abusing command injection in FontForge via a malicious ZIP file, and escalating to root by leveraging a path traversal in setuptools through a misconfigured sudo rule.

Facts WriteUp

Sat, 06 Jun 2026 00:00:00 +0000

Facts is a 🟩 Easy difficulty machine on Hack The Box. It chains the exploitation of a web CMS with a credential leak into a MinIO S3-compatible storage server, from which we extract a password-protected SSH private key. Privilege escalation is achieved by abusing a binary allowed via sudo.

🗺️ Attack Chain

Nmap → Port 80 (CamaleonCMS 2.9.0) + Port 54321 (MinIO)
│
▼
CVE-2025-2304 → Privilege Escalation + S3 Config Leak
│
▼
MinIO Credentials → Bucket "internal"
│
▼
.ssh/id_ed25519 (encrypted private key)
│
▼
ssh2john + john → passphrase: dragonballz → user: trivia
│
▼
sudo /usr/bin/facter → custom fact (.rb) → /bin/bash as root 🏴

🔍 Reconnaissance

Port Scanning

We perform reconnaissance in two phases: fast discovery followed by version detection on the found ports.

Interpreter WriteUp

Sat, 30 May 2026 00:00:00 +0000

Interpreter is a 🟨 Medium difficulty machine from the Hack The Box platform, Season 10. The attack chain combines the exploitation of Mirth Connect 4.4.0 through insecure Java deserialization to obtain unauthenticated RCE, extraction of credentials from the internal database, cracking of a PBKDF2-HMAC-SHA256 hash, and privilege escalation by abusing a Flask service with Python f-string injection.

🗺️ Attack Chain

Reconnaissance → Ports 22, 80, 443
│
▼
Web Enumeration → Mirth Connect 4.4.0 (via JNLP)
│
▼
CVE-2023-43208 → Insecure Java Deserialization → RCE as mirth
│
▼
/usr/local/mirthconnect/conf/mirth.properties → DB Credentials
│
▼
MariaDB (mc_bdd_prod) → PBKDF2-HMAC-SHA256 hash of sedric
│
▼
Hashcat (mode 10900) → snowflake1 → SSH as sedric
│
▼
/usr/local/bin/notif.py → Flask + eval() in f-strings → SSTI
│
▼
SUID bash → root 🏴

🔍 Reconnaissance

/etc/hosts Configuration

Before starting, we add the machine’s IP to the /etc/hosts file:

MonitorsFour WriteUp

Sat, 23 May 2026 00:00:00 +0000

MonitorsFour is an 🟩 Easy difficulty machine on the Hack The Box platform. The attack chain starts by exploiting an IDOR endpoint with PHP loose comparison to leak administrator credentials, continues with remote code execution in Cacti 1.2.28 via CVE-2025-24367, and ends by escaping the Docker container by abusing the daemon API exposed without authentication on the internal Docker Desktop subnet (CVE-2025-9074).

🗺️ Attack Chain

Reconnaissance → Ports 80, 5985
│
▼
Subdomain enumeration → cacti.monitorsfour.htb
│
▼
IDOR + PHP Type Juggling → /api/v1/user?token=0 → MD5 hash → marcus:wonderful1
│
▼
CVE-2025-24367 → Cacti 1.2.28 authenticated RCE → www-data in Docker container
│
▼
user.txt → /home/marcus/user.txt
│
▼
CVE-2025-9074 → Docker API on 192.168.65.7:2375 → container with C:\ mounted → root 🏴

🔍 Reconnaissance

/etc/hosts Setup

echo "10.129.38.79 monitorsfour.htb" | sudo tee -a /etc/hosts

Port Scanning

Phase 1 - Fast TCP port discovery:

Pterodactyl WriteUp

Sat, 16 May 2026 00:00:00 +0000

Pterodactyl is a 🟧 Medium difficulty Linux machine on Hack The Box, part of Season 10 (week 2). The name is no coincidence — the main attack vector is Pterodactyl Panel, a popular open-source game server manager widely deployed on the internet. The attack chain combines an unauthenticated path traversal that exposes PEAR and enables RCE, followed by database credential extraction, bcrypt hash cracking to pivot to an SSH user, and root escalation by chaining CVE-2025-6018 (PAM) with CVE-2025-6019 (udisks2/libblockdev).

Overwatch WriteUp

Sat, 09 May 2026 00:00:00 +0000

Overwatch is a 🟧 Medium difficulty machine on the Hack The Box platform. The attack chain involves enumerating an SMB share accessible with a guest account to obtain a .NET binary with embedded credentials, connecting to an MSSQL server on a non-standard port to discover a misconfigured linked server, poisoning the domain DNS (ADIDNS) to intercept cleartext credentials of a service account, accessing via WinRM and escalating privileges by abusing an internal WCF service with command injection in the KillProcess method.

Fridagate - Android Tool to Manage Frida and Intercept Traffic with Burp Suite

Wed, 15 Apr 2026 00:00:00 +0000

Fridagate is an open source Android application designed for mobile application pentesters. It allows you to manage frida-server, intercept HTTPS traffic with Burp Suite, and inject bypass scripts directly from the device — without having to run commands manually at the start of every audit session.

The project was born out of a real need: during an Android app audit the usual workflow involves connecting via ADB, pushing frida-server, setting permissions, starting it, configuring the system proxy, adding iptables rules… Fridagate automates all of that from a clean interface on the phone itself.

DarkZero WriteUp

Sat, 04 Apr 2026 00:00:00 +0000

DarkZero is a 🟥 Hard difficulty machine on the Hack The Box platform that simulates an enterprise Active Directory environment with two separate domains, multihoming, and advanced attack vectors. The ultimate goal is to fully compromise both Domain Controllers.

At the start, we are given initial credentials: 🔑 john.w:RFulUtONCOL!

🗺️ Attack Chain

Before diving into the details, here is the full attack chain at a glance:

john.w credentials
│
▼
MSSQL DC01 (guest) ──linked server──► MSSQL DC02 (sysadmin)
│
▼
xp_cmdshell ► Shell as svc_sql on DC02 (172.16.20.2)
│
▼
Ligolo-MP ► Access to internal network 172.16.20.0/24
│
▼
AD CS (Certify) ► NTLM hash of svc_sql ► Password change
│
▼
RunasCs (LogonType 5) ► SeImpersonatePrivilege
│
▼
SigmaPotato ► NT AUTHORITY\SYSTEM on DC02
│
▼
Rubeus monitor + xp_dirtree ► DC01$ TGT
│
▼
Pass-the-Ticket ► secretsdump ► DC01 Administrator hash
│
▼
evil-winrm ► Administrator on DC01 🏴

🔍 Reconnaissance

Port Scanning

We perform reconnaissance in two phases: first we quickly discover open ports, then we run detection scripts against them.

PortSwigger Labs - Exploiting LLM APIs with Excessive Agency

Mon, 09 Mar 2026 00:00:00 +0000

You’re auditing a web application that uses a Large Language Model (LLM) as a customer support assistant. On the surface it looks harmless — user asks, model answers. But underneath that chat interface something far more dangerous is hiding: the LLM has direct access to a debug API that runs arbitrary SQL commands against the production database.

That’s exactly the scenario behind the “Exploiting LLM APIs with Excessive Agency” lab from PortSwigger Web Security Academy.

Fixing the Kerberos KRB_AP_ERR_SKEW Error

Tue, 03 Mar 2026 00:00:00 +0000

You are deep into an intrusion exercise, you have successfully compromised a vulnerable certificate template in Active Directory Certificate Services (ADCS), and you already hold the precious administrator.pfx file. The logical next step is to request a Ticket Granting Ticket (TGT) and extract the administrator’s hash. You launch certipy-ad with a smile on your face, and suddenly, the terminal spits this out:

certipy-ad auth -pfx 'administrator.pfx' -dc-ip 10.2.10.10 -debug
...
[*] Using principal: 'administrator@hackpuntes.loc'
[*] Trying to get TGT...
[+] Sending AS-REQ to KDC hackpuntes.loc (10.2.10.10)
[-] Got error while trying to request TGT: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
...
impacket.krb5.kerberosv5.KerberosError: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)

That infamous KRB_AP_ERR_SKEW. The disappointment is immeasurable and your day is ruined.

IPA Signing with Sideloadly

Sat, 13 Dec 2025 00:00:00 +0000

In Apple’s closed ecosystem, arbitrary code execution is the first wall we hit. Historically, we relied on jailbreaks to audit applications, but in corporate environments or with latest-generation devices (where a stable jailbreak might not exist), we need to adapt.

This is where Sideloading comes in. Essentially, we abuse Apple’s Free Developer Account functionality to sign our own applications (or modified third-party apps) and deploy them to the target device. While tools like AltStore exist, today we focus on Sideloadly, a Swiss Army knife that not only signs but facilitates on-the-fly dynamic library injection (.dylib / Frida Gadgets).

Androdialer Writeup

Mon, 08 Dec 2025 00:00:00 +0000

AndroDialer: The Ultimate Phone Experience

Introduction

Ever wanted to break free from the limitations of your regular Android dialer? Meet AndroDialer! A sleek, full‑featured dialer app that takes your calls to the next level.

It brings together smart contact organization, customizable quick‑dial widgets, and a “Business Focus” mode that filters interruptions so you stay in control of every conversation. Behind the scenes, AndroDialer delivers in‑depth call analytics to help you spot communication trends, plus enhanced security features. Its highly adaptable interface is complete with light and dark themes, call‑time limits, and fully personalized settings that strike the ideal balance of efficiency and elegance for both personal and professional calling.

AppLocker: Bypassing Default Rules with MSBuild

Sat, 06 Dec 2025 00:00:00 +0000

AppLocker has established itself as a primary line of defense for restricting software execution within corporate environments. However, a hasty implementation that blindly relies on Default Rules can provide a false sense of security.

If an administrator configures AppLocker to allow anything signed by Microsoft or anything residing in C:\Windows\*, a malicious user could leverage native system binaries (LOLBins) to execute arbitrary code. Today, we are going to dissect how MSBuild.exe can become our gateway to a Meterpreter session, effectively evading these basic restrictions.

Discovering Tradecraft Garden

Tue, 02 Dec 2025 00:00:00 +0000

Taking advantage of the recent Black Friday deals, I decided to purchase the CRTL (Certified Red Team Lead) course from ZeroPointSecurity. While the material is dense and deeply technical (typical of Rasta Mouse ), one of the first gems I stumbled upon isn’t hidden behind a paywall. It’s a public project that deserves much more attention from the community: Tradecraft Garden .

Essentially, this repository is a development environment or “playground” designed to drastically simplify the creation of Shellcode and Position Independent Code (PIC) using C and Makefiles.

TryHackMe - Machine - Pickle Rick v2

Mon, 17 Nov 2025 00:00:00 +0000

Hey hackers! 👋

Today we’re diving into the Pickle Rick machine on TryHackMe. It’s a classic 🟩 Easy challenge, perfect for practicing web enumeration and basic privilege escalation.

🚀 Before Starting

Add the machine to the /etc/hosts file, check connectivity with ping, and create the working folders

echo '10.10.34.26\tpicklerick.thm' | sudo tee -a /etc/hosts
ping -c 1 picklerick.thm
mkdir -p ~/thm/picklerick/{exploits,fuzz,http,nmap}
cd ~/thm/picklerick/

🔎 Reconnaissance

Scan with nmap

Check all ports that are open, detect the service and its version with nmap and generate all.html to see information.

Snyk Fetch The Flag - TimeOff

Sun, 09 Mar 2025 00:00:00 +0000

In this CTF challenge, we are tasked with performing a pentest on a web application following the Model-View-Controller (MVC) pattern, developed in Ruby on Rails. The application allows employees to request time off, and we are provided with the source code and two credentials (admin and user).

While reviewing the application, we noticed that the time-off request form allows file uploads, which is always an interesting point to investigate during a security audit.

Snyk Fetch The Flag - Coding Mountains

Sat, 08 Mar 2025 00:00:00 +0000

Scripting challenges are my favorite in CTFs, and this one has undoubtedly been my favorite from Snyk Fetch The Flag 2025. The challenge consists of answering 50 quick questions about the most famous mountains on Earth. We need to answer with their height (in feet) and the year they were first climbed using the following format: height,year.

A sample of the game start:

Snyk Fetch The Flag - ClickityClack

Fri, 07 Mar 2025 00:00:00 +0000

In this challenge, we started with a pcapng file that contains the hidden flag inside. Initially, I tried to analyze it using Wireshark, but couldn’t find anything relevant. That’s when a simple Google search gave me the key clue:

pcapng usb ctf

This search led me to discover a tool called Usb_Keyboard_Parser.py that parses USB traffic packets, such as keypresses.

Snyk Fetch The Flag - Science 100

Thu, 06 Mar 2025 00:00:00 +0000

In this CTF challenge, we encounter a Robco Industries terminal, similar to the ones found in the Fallout video game series. Our mission is to decipher the correct password using the Likeness mechanic, which tells us how many letters match in the exact position with the correct password.

🖥️ Connecting to the Challenge

$ nc challenge.ctf.games 32377

Upon connecting, the system welcomes us and presents a list of potential passwords hidden among random symbols.

Snyk Fetch The Flag - CTF 101

Wed, 05 Mar 2025 00:00:00 +0000

This challenge is designed as an introduction to CTFs (Capture The Flag). It is a simple challenge aimed at getting familiar with exploiting vulnerabilities in web applications.

By analyzing the provided source code, we can see that it is a web application developed with Flask (Python). Here is the code:

from flask import Flask, render_template, request, redirect, flash
import subprocess

app = Flask(__name__)
app.secret_key = "supersecretkey"

@app.route("/", methods=["GET", "POST"])
def index():
 if request.method == "POST":
 name = request.form.get("name", "").strip()

 if not name:
 flash("Error: Name cannot be empty.", "error")
 return redirect("/")

 try:
 # I sure hope no one tries to run any commands by injecting here...
 output = subprocess.check_output(f"echo {name}", shell=True, text=True, stderr=subprocess.STDOUT)
 flash(f"Hello, {output.strip()}! Good luck!", "success")
 # ...alright, the challenges won't be this obvious on game day, but I hope it gives you a good idea of how the game is played!
 except subprocess.CalledProcessError as e:
 flash(f"Error: {e.output.strip()}", "error")

 return redirect("/")

 return render_template("index.html")

if __name__ == "__main__":
 app.run(host="0.0.0.0", port=5000)

🔍 Where is the vulnerability?

The main issue lies in the following piece of code:

Snyk Fetch The Flag - Screaming Crying Throwing up

Tue, 04 Mar 2025 00:00:00 +0000

This challenge consists of decrypting a binary file encrypted with scream . To do this, we can use the Scream Cipher Translator .

If we open the screaming.bin file in VSCode, we will see the following content:

a̮ăaa̋{áa̲aȧa̮ȧaa̮áa̲a̧ȧȧa̮ȧaa̲a̧aa̮ȧa̲aáa̮a̲aa̲a̮aaa̧}

However, if we use cat in the terminal (CMD, PowerShell, or Bash), we get a different result:

$ cat screaming.bin
aăaa{áaaȧaȧaaáaaȧȧaȧaaaaaȧaaáaaaaaaaa}

⚠️ Attention! ⚠️

Snyk Fetch The Flag - Unfurl

Mon, 03 Mar 2025 00:00:00 +0000

In this challenge, we face a web application that fetches metadata from any URL entered into the form.

A quick analysis of the source code reveals that the application is developed in NodeJS, and the use of the child_process module suggests the possibility of remote command execution (RCE).

📄 adminRoutes.js file

const { exec } = require('child_process');

router.get('/execute', (req, res) => {
 // This isn't terribly secure, but we're only going to bind this app to the localhost so you'd need to be on the actual host to run any commands.
 // So I think we're good!
 const clientIp = req.ip;

 // Definitely making sure to lock this down to the localhost
 if (clientIp !== '127.0.0.1' && clientIp !== '::1') {
 console.warn(`[WARN] Unauthorized access attempt from ${clientIp}`);
 return res.status(403).send('Forbidden: Access is restricted to localhost.');
 }

 const cmd = req.query.cmd;

 if (!cmd) {
 return res.status(400).send('No command provided!');
 }

 exec(cmd, (error, stdout, stderr) => {
 if (error) {
 console.error(`[ERROR] Command execution failed: ${error.message}`);
 return res.status(500).send(`Error: ${error.message}`);
 }

 console.log(`[INFO] Command executed: ${cmd}`);
 res.send(`
 <h1>Command Output</h1>
 <pre>${stdout || stderr}</pre>
 <a href="/admin">Back to Admin Panel</a>
 `);
 });
});

The code indicates that the application allows executing commands on the /execute endpoint via the cmd parameter, but only locally.

Snyk Fetch The Flag - Zero Ex Six One

Sun, 02 Mar 2025 00:00:00 +0000

In this challenge, we obtain a file named flag.txt.encry, which contains a hexadecimal string.

$ cat flag.txt.encry
0x070x0d0x000x060x1a0x020x540x510x050x590x530x020x510x000x530x540x070x520x040x570x550x550x050x510x560x510x530x030x550x500x050x030x050x510x590x540x000x1c

The 💡 hint in the challenge description suggests that an XOR encryption was used, and the challenge title, Zero Ex Six One, might indicate that the encryption key is 0x61.

I'm XORta out of ideas for how to get the flag. Does this look like anything to you?

Solution 1 - Using the Encryption Key

In this first solution, we convert the hexadecimal string into bytes and apply an XOR decryption using the key 🔑 0x61.

HTB Machine BountyHunter

Sat, 20 Nov 2021 00:00:00 +0000

Overview

Welcome to the writeup of the bountyhunter machine of the Hack The Box platform. BountyHunter is a Linux based machine that was active since July 24th to November 20th, on this machine we will find a XXE vulnerability and use it with a php wrapper to read internal files and get sensitive information, with the information gotten we will be able to connect to the machine through SSH, once inside the machine we will analyze a python script to find how we can abuse it to get code execution as root user and finish with the machine.

HTB Machine Explore

Sat, 30 Oct 2021 00:00:00 +0000

Welcome to the writeup of the explore machine of the Hack The Box platform. Explore is an easy difficulty machine on android.

Before starting

Connect to Hack The Box VPN in background with TMUX

tmux new -s htb
sudo openvpn ~/.vpn/htb.ovpn

Add machine to /etc/hosts file, check connection with ping and create work folders

echo '10.10.10.247 explore.htb' >> /etc/hosts
ping -c 4 explore.htb
mkdir -p ~/htb/explorer.htb/{exploits,fuzz,http,nmap}

Recon

Check all open ports, detect the service and its version with nmap

Create your own log-free VPN

Tue, 24 Nov 2020 00:00:00 +0000

Preface

Welcome to the tutorial on how to create our own log-free VPN by setting up an OpenVPN server on a cloud machine.

Before starting with the tutorial, you must create a machine in the cloud, for this tutorial, we have chosen to use a DigitalOcean VPS with an Ubuntu 20.04 machine, which has a cost of $5 per month, through the following link you can get $100 for free.

HTB Chaos Writeup

Sat, 25 May 2019 00:00:00 +0000

Hello everyone,

With this post we’re starting a new series where we’ll learn how to exploit vulnerable machines and solve hacking challenges.

We’re kicking things off with the latest retired machine from Hack The Box , Chaos.

For those who don’t know HTB, it’s a pentesting lab that provides different machines and challenges for its users. I usually recommend these types of platforms because they let us learn different technologies by tackling them head on.

About Me

Mon, 01 Jan 0001 00:00:00 +0000

Hi there! 👋 I’m Javier Olmedo, a Cybersecurity Professional and CTF Player based in Toledo, Spain.

With over 8 years of professional experience, I specialize in Offensive Security, Web Exploitation, and Red Teaming. This blog is my personal knowledge base where I document my research, CVE discoveries, and capture-the-flag methodologies.

🏆 Certifications

🎖️ Badges & Achievements

🐛 Disclosed CVEs

I have discovered and reported vulnerabilities in various software. Below is a list of my assigned CVEs.

Search

Mon, 01 Jan 0001 00:00:00 +0000