Linux

Linux machine chaining SNMP community-string enumeration, SSH password spraying, a world-writable cron script hijack, a Unix socket pivot, and a PATH-hijacked SUID binary for root.

Linux machine chaining SMTP user enumeration, a CSRF-token-aware brute force of Roundcube Webmail, CVE-2025-49113 remote code execution, and sudo apt-get privilege escalation to root.

Linux box where an unauthenticated XWiki RCE gives a foothold, database credentials are reused over SSH, and a Netdata ndsudo PATH vulnerability leads to root.

Linux machine chaining an exposed .git repository, a cPickle insecure deserialization RCE recovered from commit history, a CouchDB privilege-escalation CVE, and sudo pip abuse to root.

Linux Docker machine chaining a REST API JWT secret leaked in Git history, a Python eval() command injection, database credential recovery, and a HashiCorp Vault SSH OTP privilege escalation to root.

Linux machine chaining SMB enumeration, new-line command injection on an in-development router panel, cron job abuse, and a patched Diamorphine LKM rootkit for root.

Web challenge exploiting a ZIP-based asset upload through magic-byte forgery and a Zip Slip path traversal to plant a malicious Gunicorn hook.

Web challenge exploiting a TOCTOU race condition in a daily reward-claim endpoint using Burp Suite’s parallel Repeater requests to unlock a restricted vault.

Linux boot2root combining a NoSQL authentication bypass, Node.js SSTI, Node inspector abuse, and disk-group privilege escalation.

Web challenge working through authentication bypass, header-based blind SQL injection, UNION-based extraction, and a second-order SQL injection.