Linux

TryHackMe web challenge pairing a stored XSS payload with DNS-based data exfiltration and credential brute forcing to take over an admin account.

Linux target combining an unauthenticated Langflow RCE, JWT algorithm confusion, a malicious MCP tool registration, and a Kubernetes nodes/proxy escalation to host root.

Web application challenge chaining OTP brute forcing, a rate-limit bypass, JWT key manipulation, and remote command execution.

A practical guide for compiling older C exploits with matching GCC and GLIBC versions using Docker.

A practical Linux privilege escalation reference covering high-impact enumeration checks, common misconfigurations, credential hunting, container escapes, and last-resort kernel exploits.

Linux box exploiting an unfinished LimeSurvey install via malicious plugin upload, then Docker credential exposure and SUID abuse through a shared volume.

Linux box abusing the Jenkins CLI for arbitrary file read, cracking the recovered user hash, and reusing an SSH key for root.

Linux box that starts from an exposed Git repository, gains authenticated RCE in Backdrop CMS, and escalates through password reuse and sudo abuse of the bee CLI.

Linux machine using SSRF to reach an internal API, recovering credentials from Git history, and escalating via a GitPython command injection.

Linux machine chaining a GraphQL credential leak with authenticated blind SQL injection in HelpDeskZ, password/email brute forcing, and a GLIBC-matched kernel exploit for root.