HackNet from HackTheBox features SSTI in Django templates to leak user credentials, pickle deserialization via FileBasedCache with world-writable directory, and GPG key cracking to recover database backups containing the root password.

Previous from HackTheBox features CVE-2025-29927 (NextJS middleware auth bypass), directory traversal for file read, and three ways to abuse a Terraform sudo rule with !env_reset to get root.

In the 2025 Holiday Hack Frosty tries to freeze the neighborhood. I exploited SSTI, IDOR, prompt injection, cloud misconfigs, and reversed a SkiFree clone. Wrote a TamperMonkey plugin to teleport, walk through walls, and find hidden gnomes. KringleCon

Had a ton of fun with Flagvent this year, and finished all 25 challenges! So many quirky interesting things. My favorite challenge was the hardware leet challenge. And I got to author two easy challenges as well. 0xdf.gitlab.io/flagvent2025... Happy New Year!

WhiteRabbit from HackTheBox targets a pentester's infra with Uptime Kuma enumeration, n8n webhook SQL injection via HMAC-signed requests, restic backup recovery, and reversing a time-seeded password generator for privilege escalation.

#AdventOfCode Day 12 involves fitting presents in space under a tree. The problem for all solutions is either hard or impossible. I'll find a shortcut looking at the data and the space required for each tree. Claude gets the answer without recognizing it.

#AdventOfCode Day 11 involves nodes that connect to others. I'll use recursion to count paths through the nodes. functools cache is critical here.

#AdventOfCode Day 10 involves binary xor and linear equations. Claude tries an unfiesable long solution first when he thinks he can't use packages. When I tell him how to use packages, he uses scipy to solve quickly.

#AdventOfCode Day9 is a beast. I'll have to find squares inside a large polygon defined by almost 500 points. I'll use ray finding and edge crossing to solve it. Claude tries an unfiesable long solution first, then gets it.

#AdventOfCode Day8 showcases a union find technique to track and merge sets of points in 3D space. Claude does basically the exactly same thing I did :)

#AdventOfCode Day7 is about tracking a beam down a space as it hits things that split it into two. In part 1 I'll count the number of splits for a beam, and in part two the number of paths a particle could take choosing left or right at each split.

Editor from HackTheBox features unauthenticated Groovy script injection in XWiki's Solr search for RCE, password reuse from the Hibernate config, and PATH injection in NetData's ndsudo SetUID binary for root.

#AdventOfCode Day6 is all about handling columns of data. In part 1, I'll combine columns of ints. In part 2, I'll build the ints from columns of characters. Claude nails it quickly, but with some verbose ugly code.

#AdventOfCode Day5 is all about handling overlapping ranges. First I'll count from a list, then find the size of all the overlapping ranges.

#AdventOfCode Day4 is the first grid challenge of the year. I'll count spaces with no more than 3 filled neighbors. In part 2, I'll iterate to remove those spaces and check again until I've removed all that can be removed.

#AdventOfCode Day3 is all about finding the largest int possible from a string by selecting n digits without changing the order. Claude went for a super long running solution today, but after I told it to find a better one, it solved quickly.

One of the challenges I wrote just went live on flagvent.org

#AdventOfCode Day2 video is up! I'll compare using string operations and regex for part 1, and then regex makes part 2 trivial. Claude solves it just using string comparisons.

#AdventOfCode Day1 video released yesterday! Part 1 is pretty straight forward using modulo to track a dial as it spins around 0-99. Part 2 is a bit trickier, with some edge cases to take into account.

Holiday CTFs are here! Intro video about Advent of Code and my approach this year. (And check out https://flagvent.org/ and the Sans Holiday Hack as well).

Era from HackTheBox has multiple IDOR vulnerabilities followed by a PHP injection invoking the PHP SSH module to run commands on the host. Then there's a signed Linux binary to negotiate for root.

Mirage from HackTheBox is an Active Directory box with NATS, NFS, Kerberoasting, cross-session relay, account enabling and fixing logonHours, and ESC10.

I had a lot of fun with Outbound from HackTheBox. I'll abuse a CVE in RoundCube, then extract passwords from the database and abuse below for root. Three beyond root sections in this one :)

RustyKey from HackTheBox is an assume breach AD box. I'll Timeroast to get a better foothold, and after some AD privilege chaining with BloodHound, perform a CLSID hijack, and then abuse AddAllowedToAct to RBCD to escalate to administrator.

If you're using writeups to learn how to hack on HackTheBox (or other CTFs), use AI as a tutor. In this video I'll show a free prompt to use, as well as a Claude Skill I developed.

Dump from VulnLab released on HackTheBox last week. It has some very trick injections and a sudo rule puzzle to work out - I'll show two ways.

Voleur is an assume breach active directory box from HackTheBox. It has lots of passwords, deleted user recovery, DPAPI, targeted kerberoasting, and hashes from registry hives.

Store from VulnLab released on HackTheBox yesterday. It's got a web decryption known plaintext attack, directory traversal, node inspect, and Chrome debug.

Artificial from HackTheBox is starts with uploading a malicious TensorFlow model to get a foothold through deserialization. I'll abuse Backrest in three different ways for root.

DarkCorp from HackTheBox lived up to it's insane rating. Pivots from Linux to Windows and back, abuse of cross-OS Kerberos, and lots more. Several new techniques in this one.

TombWatcher from HackTheBox is an assume breach Windows AD box. BloodHound shows a path abusing targeted Kerberoasting, GMSA, password change, and shadow creds. Then there's AD Recycle Bin and ESC15.

Watcher from VulnLab released on HackTheBox last week. It's a web-centric box with Zabbix exploitation, and then changing the source code to capture logins. I'll escalate though TeamCity.

Uncheesable is the final challenge from the CTF the HackTheBox content team made for me as a goodbye present. I'll get a memory dump from a custom Linux kernel. I'll pull the bzImage from the dump, generate the symbols, and use vol3 to find the flag.

Certificate from HackTheBox is a hard box with a bit of everything. There's upload / zip shenanigans (two ways), PCAP analysis and Kerberos cracking, ASCS ESC3, and Golden Certificate.

Antipattern is the third video from the personal CTF the HackTheBox content team made me a as goodbye present. It's a full pwn box with my website, lots of memes, and, lots of things I always complained about when reviewing community submissions.

The HackTheBox content team made me a personal CTF as as goodbye present. In this second video, I'll show 0o337, an easy forensics challenge with a PCAP and a nice (even if unrealistic) maze to follow. Still some nice tricks to showcase.

The HackTheBox content team made me a personal CTF as as goodbye present. In this video, I'll show Farewall, a pwn challenge with a simple format string vulnerability, a few hurdles to work around, and some neat pwntools tricks at the end.

Puppy is a nice AD assume breach box. I'll abuse GenericWrite on a group, GenericAll on a user, bruteforce a KeepassXC DB, find creds in a config, and dump DPAPI stored credentials.

BabyTwo from VulnLab released on HackTheBox on Thursday. It has GPO abuse and logon script poisoning.

Fluffy from HackTheBox is a nice AD / ADCS box with CVE-2025-24071/CVE-2025-24054 to get a NetNTLMv2, and then pivot using BloodHound to get access to a user who can exploit ESC16 in the ADCS environment.

My new favorite CTF tip! If you’re stuck on a box, find a writeup and feed the solution to an llm. Use the instructions of “Do not tell me the answer under any circumstances, but guide me as I ask questions.” You’ll think critically and make progress without feeling like you cheated. #CTF #GenAI

Baby is the second VulnLab box to release on HackTheBox this week. It's an easy Windows AD box with LDAP enumeration, password spraying, and SeBackupPrivilege. I'll do the LDAP enumeration completely from netexec.

Forgotten from VulnLab released on HackTheBox today. It's a nice easy box with LimeSurvey, shared credentials, and a nice Docker abuse to get root.

Planning from HackTheBox is a nice easy box with Grafana exploitation, creds in environment variables and scripts, and Crontab UI.

Delegate from VulnLab releases yesterday on HackTheBox. There's targeted Kerberoasting and more delegation attacks, similar to Redelegate that released last month.

Environment from HackTheBox is all about exploiting Laravel and a couple CVEs in it. There's also some BASH_ENV thrown in for root.

The second vulnlab release on HackTheBox this week is Media. There's an interesting NTLM capture, followed by a pivot back to the local service account to get SeImpersonate.

Race is a neat VulnLab box now on HackTheBox involving Grav CMS, phpSysInfo, and a very fun time of check / time of use vulnerability.

Eureka from HackTheBox showcases exploiting Spring Boot and the heapdump endpoint, Spring Cloud Gateway, and some Bash arithmetic operations.

5 years ago, I spent a lot of my free time playing HackTheBox (and other CTFs). It was a dream come true when HTB offered me a position. Leaving a stable job was a bit scary, but at the end of the day, how could I say no to the thing I wanted to spend so much time doing. 1/6