TryHackMe web challenge pairing a stored XSS payload with DNS-based data exfiltration and credential brute forcing to take over an admin account.

Linux target combining an unauthenticated Langflow RCE, JWT algorithm confusion, a malicious MCP tool registration, and a Kubernetes nodes/proxy escalation to host root.

Web application challenge chaining OTP brute forcing, a rate-limit bypass, JWT key manipulation, and remote command execution.

A walkthrough of Lakera’s Gandalf Password Reveal levels, covering prompt injection, output transformation, incremental disclosure, and semantic side-channel techniques.

Active Directory machine capturing NTLM hashes from a writable SMB share, Kerberoasting a service account, forging an MSSQL Silver Ticket, and escalating via SeImpersonatePrivilege.

Active Directory box enumerating users over SMB, reusing a weak password, abusing a writable logon script, and escalating through GPO.

Active Directory machine combining anonymous LDAP enumeration, password reset abuse, SeRestorePrivilege execution, and a manual NTDS extraction.

Windows box recovering Cisco device passwords, RID brute forcing usernames, password spraying, and pulling credentials from Firefox process memory.

Linux box exploiting an unfinished LimeSurvey install via malicious plugin upload, then Docker credential exposure and SUID abuse through a shared volume.

Windows box abusing a path-traversal bug in hMailServer for credentials, capturing NTLM via a crafted email, and executing code through LibreOffice.