dirsearch

Linux box exploiting an unfinished LimeSurvey install via malicious plugin upload, then Docker credential exposure and SUID abuse through a shared volume.

Windows machine using TLS certificate enumeration to find a staging subdomain, SSRF to leak admin credentials, a PHP webshell upload for a foothold, and an AlwaysInstallElevated MSI for SYSTEM.

Windows box exploiting an IIS upload filter bypass via web.config, capped off with a kernel exploit for privilege escalation.

Windows machine using MSSQL injection to force NTLM authentication, gain WinRM access, and abuse the UniFi Video service for SYSTEM.

Windows machine using a Jenkins build step for remote code execution, a KeePass database for a Pass-the-Hash credential, and an alternate data stream hiding the root flag.

Linux box that starts from an exposed Git repository, gains authenticated RCE in Backdrop CMS, and escalates through password reuse and sudo abuse of the bee CLI.

Linux machine chaining a GraphQL credential leak with authenticated blind SQL injection in HelpDeskZ, password/email brute forcing, and a GLIBC-matched kernel exploit for root.

Linux machine bypassing a SQL injection login, forging magic bytes to upload a PHP webshell, and hijacking a SUID binary’s relative-path lshw call for root.

Linux machine exploiting a public OpenNetAdmin RCE, chaining reused database credentials into an internal-only site, and abusing a sudo-permitted nano binary for root.

Linux machine chaining an LFI-executed webshell (staged via phpLiteAdmin), a port-knocked SSH key hidden with steganography, and a chkrootkit cron exploit for root.