#web-exploitation

Articles tagged with #web-exploitation

TryHackMe: MD2PDF Writeup
Summary MD2PDF is a web app that converts user-submitted Markdown into a downloadable PDF using a server-side rendering engine. The input is not sanitized, so raw HTML is rendered as-is - including ta
Oct 7, 20269 min read1
TryHackMe - SeaSurfer writeup
Executive Summary The engagement began with a single disclosed virtual host name leaking out of an HTTP response header on the target web server. That one leak unraveled the entire box: it led to a Wo
Oct 7, 202615 min read2
TryHackMe: Python Playground Writeup
Summary Python Playground is a hard-rated TryHackMe box built around a "sandboxed" Python code execution service fronted by a Node.js/Express web app. The site advertises a blacklist-based filter that
Sep 22, 20268 min read7
TryHackMe - Olympus Writeup
Summary Olympus is a Linux box built around an old Victor CMS 1.0 install hidden under /~webmaster/. An unauthenticated SQL injection in the CMS search feature was the root of the entire chain: it dum
Sep 10, 202610 min read15
TryHackMe - CyberHeroes Writeup
Summary CyberHeros is an easy-rated web challenge built on the iPortfolio Bootstrap template. The site advertises a "login page" challenge directly in its About section. Inspection of login.html revea
Sep 9, 20264 min read20
WebVersePro : SnowedOut writeup
1. Overview The target is "Pinehollow Plow Tracker," a fictional city snow-plow dashboard running on PHP 8.2.33 behind Cloudflare. The page accepts a zone GET parameter that "centers" the map on a nam
Sep 1, 20266 min read15