27 posts · page 2 of 4
A "Security Snapshot" dashboard lets any user page through other users' packet captures by ID — one of them leaks an FTP password reused for SSH, and a stray Linux capability on python3.8 hands over root instantly.
An Azure static website leaks an over-scoped account SAS token, which exposes a hidden storage container holding service-principal credentials — and from there, a Key Vault secret whose "rotated" value is still recoverable in its previous version.
A crypto rewards app rate-limits its daily claim to once per 24h, but the check-then-act isn't atomic — firing 30 parallel requests with Burp's last-byte sync lets every one of them win the race.
A NoSQL injection auth bypass leads to an EJS SSTI RCE, then an exposed Node --inspect debugger and disk-group membership chain all the way to a raw block-device read of root.txt.
A screenshotted chat reveals an email address and a hint about a "free profile linker starting with G" — hashing the email for Gravatar and pulling its JSON profile surfaces a hidden bio with the flag.
A three-host network pivot: a Webmin RCE foothold, chisel/socat relays into an isolated GitStack server and a personal PC, a leaked git repo revealing a file-upload webshell, PHP payload obfuscation for AV evasion, and an unquoted-service-path privesc to SYSTEM.
Demo creds in an HTML comment lead to an unsafe YAML deserialization RCE in a playlist importer, then a root password exposed in plain process arguments gets reused directly for su root.
A PCAP shows a covert channel exfiltrating one byte per HTTP request inside a Cookie header — base64 plus a single-byte XOR, broken instantly with a known-plaintext crib on the flag format.