This is an arbitrary file upload due to unsanitized file names. Fix (routes.js) The vulnerability lies in /api/upload-resource as it fails to sanitize the file name first. The fixed version: ro...

This is an IDOR vulnerability as it allows for message access of any other user. Fix The function requires Auth but fails to implement any checks whatsoever which leads to IDOR. The fix would be...

Box Credentials As is common in real life Windows pentests, you will start the RustyKey box with credentials for the following account: rr.parker / 8#t5HE8L!W3A Recon Port Scanning Script and V...

Box Credentials As is common in real life Windows pentests, you will start the Administrator box with credentials for the following account: Username: Olivia Password: ichliebedich Recon Port Sc...

Box Creds As is common in Windows pentests, you will start the Certified box with credentials for the following account: Username: judith.mader Password: judith09 Recon Port Discovery ┌──(kali㉿...

Recon Port Discovery sudo nmap -PN -sC -sV -oN steamCloud 10.10.11.133 [sudo] password for kali: Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-21 13:46 PKT Nmap scan report for 10.10.11.133...

Investigating the Instance On visiting the spawned instance http://94.237.54.192:48939, we are greeted with: Something of interest is the message: Proudly powered by Flask/Jinja2 I tried inve...

Recon Port Discovery sudo nmap -PN -sC -sV -oN twomillion 10.10.11.221 [sudo] password for kali: Starting Nma...

Recon Port Discovery sudo nmap -PN -sC -sV -oN codetwo 10.129.186.144 [sudo] password for kali: Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-17 12:42 PKT Nmap scan report for 10.129.18...

Recon Port Discovery sudo nmap -PN -sC -sV -oN cicada 10.10.11.35 [sudo] password for kali: Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-15 22:27 PKT Nmap scan report for 10.10.11....