MonitorsFour
Recon Directories Enumeration ┌──(kali㉿vm-kali)-[~/htb/monitorsfour] └─$ ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt:FUZZ -u http://monitorsfour.htb/FU...
KhanMarshaI
Gavel
Recon Port Discovery ┌──(kali㉿vm-kali)-[~/htb/gavel] └─$ sudo nmap -p- --min-rate 10000 10.129.139.113 [sudo] password for kali: Starting Nmap 7.95 ( https://nmap.org ) at 2025-12-03 00:54 PST N...
NanoCorp
Recon Port Discovery ┌──(kali㉿vm-kali)-[~] └─$ rustscan -a 10.129.159.219 --ulimit 10000 <SNIP> [~] The config file is expected to be at "/home/kali/.rustscan.toml" [~] Automatically incre...
Giveback
Recon Port Scanning ┌──(kali㉿vm-kali)-[~/htb/giveback] └─$ nmap -p22,80- -sCV 10.129.103.231 Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-05 02:00 PST ┌──(kali㉿vm-kali)-[~/htb/giveback] └─...
Micro-CMS V1 - Hacker101 CTF
Understanding how the website works We are greeted by a home page that lists all pages and ability to create new pages. <!doctype html> <html> <head> <title>Mi...
Conversor
Recon Port Scanning ┌──(kali㉿vm-kali)-[~] └─$ sudo nmap -p- --min-rate 10000 10.129.200.45 [sudo] password for kali: Starting N...
How I got RCE from a File Upload on Academico - CVE-2025-10763
Vulnerability Overview I was able to achieve Remote Code Execution (RCE) via the file upload functionality on Academico. TL;DR: Academico’s profile picture upload lacks file type validation and s...
DarkZero
Box Creds We start with creds for the box: john.w / RFulUtONCOL! Recon Port Scanning ┌──(kali㉿vm-kali)-[~/htb/DarkZero] └─$ sudo nmap -PN 10.129.100.231 ...
Imagery
Recon Port Discovery ┌──(kali㉿vm-kali)-[~/htb/imagery] └─$ sudo nmap -PN -sCV -p22,8000 10.129.181.79 Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-30 21:04 PKT Nmap scan report for 10.129.1...
Expressway
Recon Port Scanning ┌──(kali㉿vm-kali)-[~/htb/expressway] └─$ sudo nmap -p500 -sCV -sU 10.129.248.177 Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-21 12:56 PKT Nmap scan report for 10.129.24...