xxd

Web challenge exploiting a ZIP-based asset upload through magic-byte forgery and a Zip Slip path traversal to plant a malicious Gunicorn hook.

TryHackMe web challenge pairing a stored XSS payload with DNS-based data exfiltration and credential brute forcing to take over an admin account.

Linux machine bypassing a SQL injection login, forging magic bytes to upload a PHP webshell, and hijacking a SUID binary’s relative-path lshw call for root.

Linux machine bypassing MIME-based upload filters with forged magic bytes, exploiting an unsanitised filename in a cron job, then a network config script’s variable-parsing quirk for root.

Linux machine exploiting an ImageMagick arbitrary file read (CVE-2022-44268) to recover a SQLite credential database, then a binwalk RCE (CVE-2022-4510) triggered via a monitored upload folder for root.