Penetration testing notes and HackTheBox writeups. Synthesized from my Obsidian vault, organized by attack surface.

Knowledge Base

TopicContent
Reconnaissance-and-Information-GatheringDiscovery, mapping, OSINT
Client-Side-VulnerabilitiesXSS, CSRF, Clickjacking, CSTI, Prototype Pollution
Server-Side-VulnerabilitiesSQLi, Command Injection, SSTI, XXE, SSRF, File Upload
Web-Application-SecurityAuth bypass, session management, business logic
Network-Security-and-ServicesProtocol exploitation, wireless, FTP/SSH/SMB/RDP
Linux-Security-and-ExploitationPrivesc, misconfigs, post-exploitation
Windows-Security-and-ExploitationPrivesc, token manipulation, registry
Active-Directory-SecurityKerberos, lateral movement, ACL abuse, ADCS
Tools-and-MethodologiesPentesting tools and workflows

HTB Writeups

MachineKey Techniques
BoardLight_ENWeb app exploitation, Linux privesc
Buff_ENWeb app exploitation, Windows privesc
Clicker_ENWeb app exploitation, Linux privesc
Codify_ENNode.js sandbox escape, Linux privesc
Devvortex_ENJoomla exploitation, Linux privesc
Editorial_ENSSRF, Linux privesc
Jarvis_ENSQLi, Linux privesc
Love_ENSSRF, Windows privesc
Mailing_ENhMailServer, CVE-2024-21413, NTLMv2 capture
Poison_ENLFI, Log Poisoning, VNC, SSH tunneling (FreeBSD)
Remote_ENNFS, CMS exploitation, Windows privesc
SolidState_ENApache James 2.3.2, POP3 enum, restricted shell escape, cron privesc
TartarSauce_ENWordPress RFI (gwolle-gb), sudo tar GTFOBins