Medium Category

blog
10+ Note
Focus
OSCP · Red Team
Structure
Recon → Exploit

Medium blog

Filters

  • CVE
    Recon & mapping

    CVE

    Analysis of the most useful vulnerabilities: PoCs, tricks for adapting them to your labs, and notes for avoiding breaking everything in production.

    Discover more Discover more
  • Walkthroughs
    Recon & mapping

    Walkthroughs

    HTB, PG, and similar machines explained as personal notes: commands, important output, and reasoning, no fluff.

    Discover more Discover more
  • HTB Schooled: Stored XSS on Moodle at Root on FreeBSD
    walkthroughs

    HTB Schooled: Stored XSS on Moodle at Root on FreeBSD

    Hack The Box Schooled Write-Up: from Stored XSS on Moodle to webshell, MySQL credentials and privilege escalation to root on FreeBSD via pkg.

    Discover more Discover more
  • HTB Mango Walkthrough: NoSQL Injection and Privilege Escalation
    walkthroughs

    HTB Mango Walkthrough: NoSQL Injection and Privilege Escalation

    Full HTB Mango walkthrough: NoSQL injection login bypass on MongoDB, credential extraction with $regex, and privilege escalation via SUID on jjs.

    Discover more Discover more
  • HTB Unattended Walkthrough: NGINX Alias ​​Bug and Root via LUKS
    walkthroughs

    HTB Unattended Walkthrough: NGINX Alias ​​Bug and Root via LUKS

    Hack The Box Unattended full writeup: NGINX alias bug, double SQL injection, LFI, session poisoning, cron poisoning and privilege escalation to root.

    Discover more Discover more
  • HTB Giddy Walkthrough: SQL Injection and CVE-2016-6914
    walkthroughs

    HTB Giddy Walkthrough: SQL Injection and CVE-2016-6914

    Hack The Box Giddy full write-up: SQL Injection, NTLMv2 hash capture, WinRM access, AV Bypass and privilege escalation to SYSTEM via CVE-2016-6914.

    Discover more Discover more
  • HTB Eighteen Walkthrough: MSSQL and private BadSuccessor(dMSA)
    walkthroughs

    HTB Eighteen Walkthrough: MSSQL and private BadSuccessor(dMSA)

    WriteUp Hack The Bpx Eighteen: MSSQL impersonation, cracking hash Werkzeug PBKDF2, privilege escalation with BadSuccessor (CVE-2025-53779) on Windows Server 2025

    Discover more Discover more
  • Voleur HTB: Writeup with Kerberoasting, DPAPI and WSL Privesc
    walkthroughs

    Voleur HTB: Writeup with Kerberoasting, DPAPI and WSL Privesc

    Voleur's full walkthrough of Hack The Box: targeted Kerberoasting, AD Recycle Bin abuse, DPAPI chaining, and privilege escalation via WSL to Administrator.

    Discover more Discover more
  • HTB Scrambled Walkthrough: Silver Ticket and .NET Deserialization
    walkthroughs

    HTB Scrambled Walkthrough: Silver Ticket and .NET Deserialization

    HTB Scrambled Writeup: Kerberoasting, Silver Ticket on MSSQL and RCE via BinaryFormatter insecure deserialization. Static analysis with dnSpy and ysoserial.net

    Discover more Discover more
  • HTB ProLab Dante: Full Review 2026 – Is It Worth It?
    walkthroughs

    HTB ProLab Dante: Full Review 2026 – Is It Worth It?

    HTB ProLab Dante review: lab structure, strengths of pivoting, real-world issues with older OSes and unintended CVEs. Who really needs it and when to skip it.

    Discover more Discover more