27 posts · page 3 of 4
A "free" wellness app hands out unauthenticated Cognito guest credentials, and an over-scoped IAM role lets those guest credentials Scan the entire DynamoDB table instead of just one record.
A Flask app leaves .git/ reachable — git-dumper reconstructs the full repo, and a "remove before launch" note in the staging README hands over the flag directly.
An LLM hotel concierge gates its system prompt behind guest "trust" rather than real auth — claiming a recognized name plus asking it to reveal its instructions dumps the whole prompt, escalation code included.
OSINT-harvested employee emails feed a credential spray against an hMailServer instance, and the resulting SMTP access is used to phish a reverse-shell payload straight to the mail server itself.
Chained credential attacks across a segmented AD network: SSH user enumeration, cleartext creds in a Password Safe backup, a SOCKS pivot through a jump host, and an LSASS dump feeding a DCSync.
Two-factor login bypassed via OTP mass assignment (brute force also works, but was not the intended path), then a curl-injection bug in a feed importer used to read /var/www/user.txt off the box.
White-box Java Spring app: hardcoded/actuator-leaked credentials, a UNION-based SQL injection, mass-assignment privilege escalation to WARDEN, and a commons-collections gadget chain for RCE.
Active Directory chain: guest-account Kerberoasting, password reuse, a targeted Kerberoast via GenericWrite, and hardcoded creds in a PowerShell script leading to a SYSTEM shell.