TryHackMeHard
TryHackMe: IronHold
White-box Java Spring app: hardcoded/actuator-leaked credentials, a UNION-based SQL injection, mass-assignment privilege escalation to WARDEN, and a commons-collections gadget chain for RCE.
- #web
- #sql-injection
- #deserialization
- #privesc