ippsec-video-index.json

{
  "metadata": {
    "source": "ippsec.rocks dataset.json + web research",
    "total_entries": 9245,
    "total_unique_content": 533,
    "generated": "2026-04-10",
    "ippsec_youtube": "https://youtube.com/ippsec",
    "ippsec_search": "https://ippsec.rocks",
    "ippsec_github": "https://github.com/IppSec",
    "ippsec_contributions": "https://ippsec.rocks/contributions/"
  },
  "stats": {
    "htb_machines": 432,
    "uhc_machines": 12,
    "vulnhub_machines": 4,
    "academy_modules": 17,
    "sherlocks_dfir": 7,
    "tutorials_methodology": 61
  },
  "machines": [
    {
      "name": "Flight",
      "os": "Windows",
      "difficulty": "Hard",
      "techniques": [
        "Introduction",
        "Start of Nmap",
        "Playing with the web page, but everything is static doing a VHOST Bruteforce to discover school.flight.htb",
        "Discovering the view parameter and suspecting File Disclosure, testing by including index.php and seeing the source code",
        "Since this is a Windows, try to include a file off a SMB Share and steal the NTLMv2 Hash of the webserver then crack it",
        "Running CrackMapExec (CME) checking shares, doing a Spider_Plus to see the files in users",
        "Running CrackMapExec (CME) to create a list of users on the box then doing a password spray to discover a duplicate password",
        "Checking the shares with S.Moon and discovering we can write to the Shared Directory",
        "Using NTLM_Theft to create a bunch of files that would attempt to steal NTLM Hashes of users when browsing to a directory getting C.Bum's creds with Desktop.ini",
        "C.Bum can write to Web, dropping a reverse shell",
        "Reverse shell returned as svc_apache, discovering inetpub directory that c.bum can write to",
        "Using RunasCS.EXE to switch users to cbum"
      ]
    },
    {
      "name": "RegistryTwo",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Enumerating port 5000/5001 to see a Docker Registry and Auth Server",
        "Creating our auth token for the Docker Registry",
        "Adding the SSL Cert to our certificate store, then doing a docker pull to download and run the container",
        "Discovering JSESSIONID Cookie, attempting the weird directory traversal bug of /..;/ (nginx directory didn't have a trailing slash on the location)",
        "The Examples directory has a sessions example that lets us modify the session, doing this to get a File Disclosure vulnerability then downloading the WAR file hosting the app",
        "Opening the WAR in JD-GUI then examining the source code, discovering we can change our user to admin by editing the session",
        "Pointing the RMI.HOST back to us, then use YSOSERIAL to host a malicious server",
        "YSOSERIAL-MODIFIED Docker is up, using YSOSERIAL to start a JRMP Listener and host a malicious payload",
        "Shell on the container, showing where IPv6 addresses are stored (/proc/if_inet6) and that we could have gotten this with the file disclosure which allows for bypassing the firewall, did not need to do",
        "Looking at the source code again, discovering we can use the RMI to perform file operations on the host"
      ]
    },
    {
      "name": "Zipping",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering a likely LFI in product.php but cannot use filters, likely because there is a file_exists() check",
        "Playing with the File Upload functionality",
        "Talking about the PHAR wrapper in PHP, showing it will bypass the file_exist and we can go into the ZIP to bypass the .pdf check",
        "Uploading the phar archive, and getting RCE through the LFI and PHAR wrapper",
        "Showing the intended File Disclosure vulnerability, by uploading a zip with a symlink",
        "Creating a python script to automate the file disclosure vulnerability, making it easier for us to download files",
        "Script completed, looking at the PHP Code, then showing another unintended solution with a zip file and null byte",
        "Explaining what happened with the null byte",
        "Showing the intended solution with the null byte, talking about how we can bypass this regex with CRLF Injection due to lack of multi-line",
        "Dumping the SQL Database with a union injection"
      ]
    },
    {
      "name": "Aragog",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of Recon",
        "Notice SSH configured for Pub Key Only.  Hint at what to grab later!",
        "Grabbing test.txt off ftp server via anonymous auth",
        "Determining if I want to go down the \"Exploit VSFTPD\" rabbit hole",
        "Viewing test.txt and hosts.php",
        "Figuring out how hosts.php works and discovering XXE",
        "Start of XXE Discovery",
        "Making the XXE Output /etc/passwd",
        "Encoding output in Base64 in order to view PHP Files",
        "Using Burp Intruder to BruteForce Files",
        "Creating a program to bruteforce home directories",
        "Program Finished.  Finding SSH ID_RSA Key"
      ]
    },
    {
      "name": "Absolute",
      "os": "Windows",
      "difficulty": "Insane",
      "techniques": [
        "Start of nmap discovering Active Directory (AD)",
        "Using wget to mirror the website, then a find command with exec to run exiftool and extract all user names in metadata",
        "Using Username Anarchy to build a wordlist of users from our dump and then Kerbrute to enumerate valid ones",
        "Building Kerbrute from source to get the latest feature of auto ASREP Roasting",
        "Kerbrute pulled the wrong type of hash, using the downgrade to pull etype 18 of the hash",
        "Running Bloodhound with D.Klay, using Kerberos authentication",
        "Going over the bloodhound data and finding some attack paths",
        "Manually parsing the Bloodhound with JQ to show descriptions for all users and finding the SVC_SMB password in the Description",
        "EDIT: Don't want to use Blodhound? Showing LdapSearch with Kerberos, and why the FQDN has to be first in the /etc/hosts file",
        "End of edit: Using SMBClient with SVC_SMB and Kerberos to download files",
        "Sharing my internet connection from Linux to Windows, so I can run test.exe on Windows"
      ]
    },
    {
      "name": "Academy",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of nmap",
        "Adding academy to our host file, then taking a look at the web page",
        "Discovering a weird port (33060), attempting to enumerate it manually",
        "Discovering admin.php from our gobuster results",
        "Playing with having spaces in usernames, then seeing roleid in the parameter",
        "Creating and logging in with an admin to see a new vhost",
        "Looking for Laravel Exploits, finding a metasploit module",
        "Getting the APP_KEY from the laravel error page, which is needed for exploitation",
        "Using metasploit to exploit Laravel and send the requests through burpsuite so we can analyze the exploit",
        "Analyzing the exploit, going to CyberChef to decrypt the payload",
        "Reverse Shell returned"
      ]
    },
    {
      "name": "Academy Intro",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Academy URL: https://academy.hackthebox.eu",
        "Accessing Academy",
        "Talking about Paths",
        "Talking about what a Cube is",
        "Showing all the modules and tiers",
        "Starting the Intro to Academy Course",
        "Showcasing interactive modules by starting a pwnbox instance",
        "Spawning a lab to interact with"
      ]
    },
    {
      "name": "Access",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Begin of recon: ftp, telnet, IIS 7.5",
        "Downloading all files off an FTP Server with WGET",
        "Examining the \"Access Control.zip\" file.",
        "Cracking a zip file with John",
        "Creating a wordlist for cracking the zip (strings of the mdb file)",
        "Exploring the MDB Files (Access Database) with MDBTools (mdb-sql and mdb-tables)",
        "Grabbing the same password we cracked by checking the auth_user table",
        "Converting the PST File (Outlook Email) to PlainText via readpst",
        "Logging into telnet with the credentials from the email",
        "Switching to a Nishang Shell to execute powershell",
        "Running JAWS (Just Another Windows Scanner)",
        "Discovering Stored Credentials on the box for ACCESS\\Administrator"
      ]
    },
    {
      "name": "Active",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Begin of recon",
        "Poking at DNS - Nothing really important.",
        "Examining what NMAP Scripts are ran.",
        "Lets just try out smbclient to list shares available",
        "Using SMBMap to show the same thing, a great recon tool!",
        "Pillaging the Replication Share with SMBMap",
        "Discovering Groups.xml and then decrypting passwords from it",
        "Dumping Active Directory users from linux with Impacket GetADUsers",
        "Using SMBMap with our user credentials to look for more shares",
        "Switching to Windows to run BloodHound against the domain",
        "Analyzing BloodHound Output to discover Kerberostable user",
        "Performing Kerberoast attack from linux with Impacket GetUsersSPNs"
      ]
    },
    {
      "name": "Acute",
      "os": "Windows",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap, the Server Header changes based upon DNS",
        "Navigating to the website, discovering the \"New Starter Form\" which has some key information like a welcome password and username convention",
        "Password spraying the Powershell Web Access (PSWA), discovering a valid credential but wrong host, word document had another host which is valid for edavies",
        "Playing around in the PSWA",
        "Looking at hidden files, discovering c:\\utils\\desktop.ini which states its a directory that is excluded by AV",
        "Making the mistake of running WinPEAS inside the PSWA",
        "Setting up ConPtyShell to get a proper PTY reverse shell on windows",
        "Making some light modifications to ConPtyShell in order to evade antivirus",
        "Getting the ConPtyShell and showing the colors/tab autocomplete",
        "Running WinPEAS to show another user is logged on (and the AV Exclusions)",
        "Switching to Metasploit, because it makes it easier to migrate into an interactive process, which allows us access to view the desktop of the logged in user"
      ]
    },
    {
      "name": "Administrator",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction, assumed breach box",
        "Start of nmap",
        "Checking out what the credentials we are given go to, see WinRM but it doesn't give us much",
        "Running python bloodhound as olivia",
        "Looking at the json output manually to discover non-default groups",
        "Examining Olivia's outbound controls to see there is a chain to Benjamin, who has FTP Access",
        "Using Net RPC to change Michael and Benjamin's password",
        "Downloading the Password Safe database off the FTP Server, then cracking it",
        "Extracting the passwords from the password safe and then spraying to find Emily's is still valid",
        "Going back to Bloodhound, discovering Emily has GenericWrite over Ethan, who can DCSync.",
        "Running TargetedKerberoast to take advantage over GenericWrite and make Ethan's account kerberoastable and then crack it",
        "Running SecretsDump then talking about other flags like PasswordHistory"
      ]
    },
    {
      "name": "Admirer",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Doing nmap quickly by not running scripts to get open ports, then using that output to run scripts.",
        "Checking out the webserver, discovering robots.txt",
        "Running gobuster on the admin-dir with the extensions txt and php",
        "Finding credentials.txt within that admin-dir",
        "Logging into FTP to discover the web directory source",
        "Running gobuster again on utility-scripts to discover adminer.php",
        "Going to adminer and trying to login",
        "Bypassing adminer authentication by creating a MySQL Database",
        "Failing to drop a file in adminer",
        "Using LOAD DATA LOCAL to insert a file into our database",
        "Uploading the servers index.php to our database and discovering the password",
        "SSH into the server with the password found before"
      ]
    },
    {
      "name": "AdmirerToo",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap, discovering a webserver and filtered port",
        "Discovering a hostname in the 404 not found message in the mailto section",
        "Gobuster VHOST Discoery finds the subdomain db.admirer-gallery.htb which is adminer. Playing with the application and raw SQL Commands",
        "Trying to write files with INTO OUTFILE, also testing the secure file priv default directory for MySQL which is the most reliable",
        "Going to google and finding this version of adminer is vulnerable to a SSRF, but having trouble with this because the login for adminer is different",
        "Intercepting the login request, finding a hardcoded password that doesn't really help us",
        "Installing adminer in a docker container, so we can play with the application locally which helps us understand the SSRF Exploit",
        "Finding a python3 http server redirect example to use for our SSRF",
        "Performing the SSRF Vulnerability failing to extract local files",
        "The CSRF is annoying, configuring burpsuite to replace variables in our post automatically so we don't need to manually intercept.",
        "Having the SSRF access localhost:4242 (the filtered port from nmap), we see the OpenTSDB application, finding an exploit"
      ]
    },
    {
      "name": "Aero",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Looking for Windows Exploits around Themes and discovering ThemeBleed (CVE-2023-38146)",
        "Creating a DLL that exports VerifyThemeVersion and then compiling from Linux",
        "Showing the exports of the DLL to confirm it is there, then hiding the ReverseShell export",
        "Testing our DLL from our windows computer",
        "Creating the malicious Windows Theme",
        "Setting up a SOCAT forward to send port 445 from our linux box to our Windows Box",
        "Updating the IP Address in our DLL and then getting a shell",
        "Downloading the PDF by converting it to base64 and then copy and pasting it to our box",
        "Researching CVE-2023-28252, which is a Windows Local Privesc in the Common Log File System (CLFS) and patched back in April 2023",
        "Opening the CLFS Exploit up in Visual Studio and placing a Powershell Web Cradle to send a reverse shell and getting Root"
      ]
    },
    {
      "name": "Agile",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Description timestamps will be populated later today."
      ]
    },
    {
      "name": "AI",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of Recon",
        "Taking a look at the page, noticing the site is PHP, running GoBuster to find other PHP Files.",
        "Playing with the File Upload, failing to identify how uploaded files are stored",
        "Investigating PHP Files that GoBuster found, discovering intelligence.php",
        "Searching for Text to Speach programs (create WAV Files)",
        "The first program didn't do a good job saving WAV Files, Downloading Festival",
        "Installing apt-file so we can use apt to search for what package contains a file (like yum whatprovides)",
        "Using text2wave to create wav files and upload them, then discover a SQL Injection over voice",
        "Having trouble getting the voice recognition to recognize the word union.  Using \"intelligence.php\" to discover alternative words.",
        "Extracting the username and password out of the database, then logging in via SSH",
        "Investigating how the file upload script works, turns out to be a dead end",
        "Running linPEAS to check other privesc paths (see JDWP)"
      ]
    },
    {
      "name": "Alert",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Enumerating the Link_Share for Directory Traversal, coming up with nothing",
        "Discovering XSS in the Contact Us Form",
        "Playing with the XSS, we keep getting extra URL Encoded data turns out its not XSS but instead the admin is clicking links",
        "Sending only a link, discovering they click it. Now we need to find XSS in a page so manipulate their browser. Playing with the Markdown converter",
        "Creating an XSS Payload that will navigate to a page and send us the page and discovering a messages page",
        "The page shows us there is a messages.php file, showing other ways to see this. Then finding a file disclosure vulnerability",
        "Downloading the HTPASSWD from our File Disclosure vulnerability, then cracking it",
        "SSH into the box as Albert, looking for any databases we can exfil",
        "Discovering there is a PHP Webserver running as root in /opt/website-monitor and we can write files to the config. Dropping a php script to get root"
      ]
    },
    {
      "name": "Ambassador",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Discovering Grafana and seeing it is ~2 years old",
        "Looking for exploits",
        "Manually performing the exploit",
        "Looking for interesting files, extracting Grafana config which lets us log in",
        "Extracting the SQLite3 Database in order to get the MySQL Password",
        "Logging into MySQL and getting SSH Creds from the whackywidget database",
        "Looking at the WhackyWidget application and discovering an Consul API Key",
        "Looking for the Consul API Documentation",
        "Playing with the API, examining the Metasploit script and building out our curl request",
        "Building a JSON file which will create a Consul Script to send us a reverse shell and getting root"
      ]
    },
    {
      "name": "Analysis",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering the internal.analysis.htb subdomain",
        "Talking about why I want to run FeroxBuster here and showing the menu so we can stop crawling non-interesting directories (ex: js, css, img)",
        "Discovering list.php in users and fuzzing parameters",
        "Start of program to bruteforce usernames",
        "Got the first character of every username, get the full name",
        "Discovering the script it vulnerable to LDAP Injection",
        "Converting our ldap username bruteforcer to exploit this ldap injection and exfil fields",
        "Talking about having to deal with wildcards in the field",
        "Completing the script",
        "Discovering we can upload PHP Scripts using the SOC Report page"
      ]
    },
    {
      "name": "Analytics",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering Metabase, noticing the HTTP Headers are different. Checking TTL just to see if it decrements from the main web page.",
        "Searching for an exploit for metabase, then enumerating version",
        "Manually exploiting Metabase by pulling the setup-token, then getting injection on the /setup/validate endpoint through the JDBC Driver",
        "Reverse shell returned",
        "Discovering credentials in the environment variables, then ssh into the box",
        "Googling the kernel to discover its vulnerable to GameOverlay",
        "Explaining the gameoverlay exploit (CVE-2023-23640, CVE-2023-32629)",
        "Stepping through the exploit manually to understand how the overlay fs works, and what the exploit did to abuse it",
        "Looking into the permissions of the binaries that were created"
      ]
    },
    {
      "name": "Anubis",
      "os": "Windows",
      "difficulty": "Insane",
      "techniques": [
        "Start of nmap, getting hostname and",
        "Discovering the Server Header changes for virtualhost, probably navigating to a different box/container/etc [MasterRecon]",
        "Getting a good SSTI Fuzz String then identifying this string causes an error on the webserver. Removing parts of the string until we see the type of SSTI",
        "Playing with ASP Code in this SSTI or ASP Code Injection... Not sure what the vulnerability is",
        "Getting a VBScript One Liner to execute code and then getting a reverse shell",
        "Discovering a x509 certificate, decoding it with openssl, and discovering a second hostname",
        "Downloading and running chisel to setup a reverse socks proxy so we can attempt to pivot through this container",
        "Running nmap through the chisel socks proxy with proxychains",
        "Setting FoxyProxy to only send specific domains through our proxy",
        "Discovering the softwareportal.windcorp.htb attempts to install software on machines, set it to our machine and wireshark to see how 3it connects back to us",
        "Using responder to intercept the WinRM Connection and then use hashcat to crack the credentials"
      ]
    },
    {
      "name": "Apocalyst",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Enumeration Start",
        "WPScan Start",
        "Directory Scanning with GoBuster",
        "Examining WPScan Output",
        "Bruteforcing with WPScan",
        "Bruteforcing HTTP Post with Hydra",
        "Edit WP Theme to get Code Execution",
        "Return of Reverse Shell",
        "Privelege Escalation Word Writeable Passwd"
      ]
    },
    {
      "name": "AppSanity",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap, showing 5985 isn't in the top1000 so doing a full port scan",
        "Taking a look at the MedDigi website",
        "Taking a look at the Signup Request seeing AcctType",
        "Changing the AcctType to 2 and getting a different privilege",
        "VHost enumeration shows the portal.meddigi.htb domain, using our pre-existing session from the main page on this domain to bypass login",
        "Discovering SSRF in the Prescriptions page",
        "Discovering the File Upload requires a PDF but checks the magic bytes so we can make a PDF Header on our file and upload ASPX Web Shells",
        "Going back to the SSRF and discovering we can use time-based queries to identify ports listening on localhost",
        "Using FFUF to filter by duration to show us the requests that don't take a long time",
        "Discovering port 8080 shows our upload location, then navigating to it and getting a shell",
        "Finding DLL's the webserver uses, they are dotnet so copying them to a windows box so we can use dnspy and finding a password"
      ]
    },
    {
      "name": "APT",
      "os": "Windows",
      "difficulty": "Insane",
      "techniques": [
        "Start of nmap and poking at the webserver",
        "Looking into MSRPC, showing MSF info overflow which is why I had historically ignored it",
        "Poking at RPC with Impacket's RPCMap",
        "Converting a RPC Script to get IPv6 address from Python2 to Python3",
        "Using nmap to scan the IPv6 Address",
        "Showing how I would enumerate a Firewall, nothing works here but something I do.",
        "Finding SMB accepts anonymous users and contains an Active Directory Backup",
        "Using Impacket's SecretsDump to extract the NTDS.DIT with password last set, user status, and history",
        "Using KerBrute to enumerate valid users on the box based upon the AD Backup",
        "Using PyKerbrute to bruteforce Henry.Vinson's account",
        "Using Socat + CrackMapExec to enumerate IPv6 (if i updated CME, it would be able to do IPv6)"
      ]
    },
    {
      "name": "Arctic",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Enumerate with nmap",
        "Going to the webpage",
        "Using SearchSploit to find ColdFusion Exploits",
        "Attempt to exploit through MSF. Debug why it failed.",
        "Setting up a Burp Redirect listener",
        "Examining request send by MSF Exploit",
        "Getting a reverse shell",
        "Using Unicorn to create a Powershell Meterpreter Loa",
        "Reverseshell returned",
        "Using the MSF post module local_exploit_suggestor"
      ]
    },
    {
      "name": "Ariekei",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Explaining VM Layout",
        "Poking at Virtual Host Routing (Beehive & Calvin)",
        "Fixing GoBuster to find /cgi-bin/",
        "Enumerating WAF (Web Application Firewall), to see how it detects Shellshock",
        "Using VirtualHostRouting to navigate to Calvin.htb.htb",
        "Using ImageTragick to exploit Calvin",
        "Calvin Reverse shell returned",
        "Poking at /common, which allows pivot to Bastion Host",
        "SSH into the Bastion Host",
        "Explain SSH Local and Remote Port Forwarding",
        "Beehive Reverse Shell Returned"
      ]
    },
    {
      "name": "Arkham",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Begin of Recon",
        "Checking the WebPages",
        "Examining /userSubscribe.faces, to discover potential deserialization",
        "Exploring javax.faces.ViewState",
        "Googling around to see what an unencrypted serialized object should look like",
        "Checking out SMB to discover an openshare",
        "Downloading appserver.zip from batshare via smbclient",
        "Cracking a luks encrypted file with dd and hashcat",
        "Luks cracked, mounting the disk with luksOpen",
        "Discovery of the secret used to encrypt the java object",
        "Creating a python script to decrypt the ViewState to verify we have correct crypto settings",
        "Script completed, lets test the decryption!"
      ]
    },
    {
      "name": "Armageddon",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of the box, showing a quick way to nmap",
        "Looking at web page",
        "Looking for Drupal Scanners",
        "Showing how I would fingerprint opensource apps if there was no scanner",
        "Using DroopeScan to scan the site",
        "Starting to use Drupalgeddon2 to get a shell",
        "Installing gems so DrupalGeddon works",
        "Drupalgeddon2 works, going from a webshell to reverse shell",
        "Confused about OSError: out of pty devices when improving the shell, give up eventually",
        "Looking for users on the box, then hunting for the Drupal configuration",
        "Cannot find the drupal configuration, going to google and asking for how to change the SQL Password"
      ]
    },
    {
      "name": "Artificial",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Looking at Upload Modules, can see the version of python/tensorflow looking for a way to get RCE in tensorflow h5 files",
        "Using docker to run the tensorflow, mounting our cwd in the docker to make it easy to copy files from the docker image",
        "Shell returned, looking at the database to get a password hash and cracking it to get another user",
        "SSH as the Gael User, discover another webserver running on port 9898 which is BackRest",
        "Using find to show files by user/group and discovering a backup of BackRest which contains the password hash, crack it",
        "Getting root.txt by backing it up and downloading it",
        "Getting root by putting a command in the backup job hook",
        "Showing another way to get root by command injection in Restic"
      ]
    },
    {
      "name": "Atom",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Running RPCDump which shows if this is vulnerable to PrintNightmare (Exploit it later)",
        "Examining the webpage",
        "Explaining why i use lowercase wordlists on against Windows Webservers",
        "Listing shares with smbclient to find an open share",
        "Decompiling the Electron installer/app with asar",
        "Everything is extracted looking at package.json and main.js to find electron-updater",
        "Searching for exploits within Electron",
        "Using MSFVENOM to build a reverse shell",
        "Editing our installer YAML to point to our reverse shell",
        "Putting the files on the share and getting our reverse shell"
      ]
    },
    {
      "name": "Attended",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Showing a tmux keybinding to",
        "Setting up an IPTables rule to log new connections",
        "Using SWAKS to send an email",
        "Starting up a python SMTP Server so we can see the email coming back to us",
        "Finding a VIM RCE and verifying it works by using ping",
        "Testing a python2 web cradle within the VIM Exploit",
        "Explaining how our C2 is going to work and why what we are doing it uniquely",
        "Quick high level overview of the C2 Program we are creating",
        "Start coding the C2",
        "Demoing the C2 Keeping the HTTP Request alive until a command is sent",
        "Updating our Client/Implant to work with the new C2"
      ]
    },
    {
      "name": "Authority",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Taking a look at the website",
        "Using NetExec to search for file shares and discovering the Development share is open. Using smbclient to download everything",
        "Exploring the Ansible Playbooks in the Development Share to discover encrypted passwords (ansible vault)",
        "Converting the Ansible Vault Hashes to John/Hashcat format so we can crack them",
        "Decrypting the values and getting some passwords, one of which lets us log into PWM (webapp)",
        "Adding a rogue ldap server into the PWM Config, then clicking test config will send us the password for the ldap account",
        "Running Certipy to find the server is vulnerable to ESC1, we just need to enroll a computer",
        "Using NetExec to show how the MachineAccoutnQuote, confirming we can enroll machines",
        "Using Impacket to add a rogue computer",
        "Using Certipy to perform the ESC1, it works but smart card login isn't enabled so we can't log in right away."
      ]
    },
    {
      "name": "Awkward",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Taking a look at the web page, finding users on the site, and using FFUF to VHost Enumeration due to talking about a store",
        "Fingerprinting the websites, dev looks to be PHP and the main page appears to be Vue",
        "Exploring the vue app in Firefox Dev Tools, discovering some routes in the webpack which lead to an API",
        "An JWT error message is displayed when accessing some API Pages, removing the token and bypassing authentication",
        "Explaining why the web application skips authentication when a cookie is not present, and showing how similar it was to the OMIGod Vulnerability",
        "Extracting all users from the page and then using curl to save the hashes to a file.  Use CrackStation to crack hashes and get a cred",
        "Logged in as Christopher.Jones, checking the Online Store Status link which is vulnerable to SSRF",
        "Using FFUF to fuzz for all possible ports and using a bash trick to create a wordlist based upon a range of numbers without creating a file",
        "Discovering some API Documentation on a page on port 3002",
        "The API all-leave page uses awk, and we can abuse this binary to perform a file disclosure vulnerability if we can poison user names."
      ]
    },
    {
      "name": "Axlle",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Looking at what an XLL Is",
        "Finding a skeleton xll payload, then compiling it on Linux",
        "Shell returned, grabbing the NTLMv2 Hash of our user with responder",
        "Looking into hMailServer, discovering emails from other users. Hints at dropping URL Shortcuts in a directory",
        "Converting the XLL Payload to an exe, then uploading it to the box and creating a URL Shortcut and getting shell as Dallon.Matrix",
        "Using Powershell to search a directory for files containing password, discovering the Powershell ConsoleHost_History",
        "Using Bloodhound.Py to get bloodhound data",
        "Discovering we can ForceChangePassword on other users",
        "For some reason our Bloodhound Python Ingestor didn't get the WinRM Edge, running Sharphound to see it should of been there",
        "The users in App Dev can enter the \"App Development\" directory which has a program called kbfiltr, and a hint towards StandaloneRunner.exe being ran"
      ]
    },
    {
      "name": "Backdoor",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of nmap",
        "Starting WPSCAN",
        "There's no index.php in wp-content/plugins/, which lets us find a vulnerable plugin (eBook Download 1.1)",
        "Playing with the eBook Download LFI",
        "Doing a full nmap portscan",
        "Using the LFI to extract the process names with curling /proc and doing some cut/sed magic",
        "Downloading the cmdline for the first 1000 PID's",
        "Using find to show us files greater than a couple bytes to show us every valid PID",
        "Examining the final output, discovering screen running and gdb",
        "Using metasploit to exploit GDB",
        "Reverse shell returned, playing with screen to connect to the session"
      ]
    },
    {
      "name": "Backfire",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Showing Havoc adding the X-HAVOC true header on GET/POST requests on its HTTP Hosting Service",
        "Seraching CVEDetails finding CVE-2024-41570 which is a SSRF",
        "Some quick C2 talk before we dive into the SSRF",
        "Going over the Havoc SSRF Script",
        "Talking about a research article that looked at multiple open-source C2's and the vulnerabilities they had",
        "Allowing our SSRF to make a websocket connection, which lets us authenticate and perform the RCE in Havoc",
        "Getting a shell, explaining our attack chain again",
        "Discovering Hardhatc2, looking at google and seeing it has a static JWT Signing Key",
        "Standing up HardHat c2 via docker to craft an authenticated cookie, then tunneling to backfire and bypassing auth. Use terminal to get shell",
        "Our new user can run iptables/iptables-save with sudo. Using this combo to write to roots authorized_keys2 to get a shell, which is a bit safer than authorized_keys"
      ]
    },
    {
      "name": "Bagel",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Taking a look at the web page",
        "Looking for LFI, then exploring /proc to find where the application is and extracting the source code",
        "Taking a look at the Python Source Code and discovering port 5000 is the dotnet application and uses websockets",
        "Using wscat to test the websocket",
        "Bruteforcing the /proc/{pid}/cmdline directory in order to see running processes and find the dotnet dll",
        "Reversing Bagel.dll and discovering a deserialization vulnerability in dotnet which allows us to read files",
        "Looking at what TypeNameHandling means in NewtonSoft's deserialize",
        "Looking for a gadget to use with our deserialization",
        "Building the deserialization payload",
        "Dumping Phil's SSH Key, then logging in"
      ]
    },
    {
      "name": "Bank",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Nmap Results",
        "DNS Enumeration",
        "HTTP VirtualHost Routing",
        "DirSearch (Web Enumeration)",
        "HTTP Redirect Vulnerability",
        "PW in Balance-Transfer",
        "File Upload, WebShell",
        "First Shell",
        "First Privesc Method (SUID)",
        "Second Privesc Method (passwd)"
      ]
    },
    {
      "name": "BankRobber",
      "os": "Windows",
      "difficulty": "Insane",
      "techniques": [
        "Begin of nmap, discover XAMPP",
        "Running GoBuster while we poke at the website",
        "Registering an account then seeing what new functions are avaialble",
        "Attempting to transfer money and discovering XSS",
        "Basic Cross Site Scripting worked, check cookies to see HttpOnly is false then do a basic XSS to steal cookies",
        "Doing the OnError payload to steal administrative cookie",
        "Logging in as the administrative user, checking out the new pages. Search which is SQL Injectable and BackDoorChecker which can execute code from localhost",
        "Playing with the SQL Injection in Search, confirming it is union then sending it to SQLMap to dump the database",
        "Using SQL Injection to read the source code via LOAD_FILE in a Union Injection.",
        "Creating a XSS Payload that can send a Post Request (XMLHttpRequest)",
        "Reverse shell returned",
        "Manually poking around the box, discover port 910 is open but our nmap didn't show it"
      ]
    },
    {
      "name": "Bart",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Begin Recon, Windows IIS/OS Mapping and GoBuster",
        "Explanation of Virtual Host Routing",
        "Developers name exposed in HTML Source, also discover /monitor",
        "Enumerating Username in PHP Server Monitor: Challenge Watch Sense to und",
        "erstand CSRF and write an automated bruteforcer",
        "Discover of Internal-01.bart.htb",
        "Harveys Password with Hydra (Note: This is bypassable if you DIRBUST to find /Log/log.php)",
        "Finally got Hydra to return the password!",
        "Log Poisoning + LFI = Remote Code Execution",
        "Return of Reverse Shell",
        "Why you should check if you're a 32-bit process on a 64-bit machine",
        "### Start of Failing attempting to do a RunAs... Lol."
      ]
    },
    {
      "name": "Bastard",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Sherlock was fixed, should no longer report the false negative https://github.com/rasta-mouse/Sherlock/commit/ceb49f5b54be54effbada47fa3198abf744af390",
        "If you wanted to do this with MSF -- Watch the Arctic Video and use the exploit shown in the video.  If it doesn't work, try changing the payload with the exploit and ensure you're a 64 bit process."
      ]
    },
    {
      "name": "Bastion",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Begin of recon",
        "Using SMBClient to view open shares, discover /Backups",
        "Mount the SMB Share",
        "Playing with SMBMap which is a bit more automated but write files!",
        "Checking out files in the /Backups share",
        "Using 7zip to view files in a VHD file",
        "Installing libguestfs-tools in order to use guestmount",
        "Mounting the VHD with guestmount",
        "Extracting local passwords from SAM and SYSTEM with secretsdump",
        "Cracking the hash and then using SSH to login to the box",
        "Viewing local adminstrators and seeing administrators is not actually disabled (backup indicated it was)",
        "Running JAWS"
      ]
    },
    {
      "name": "Beep",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Watch me fail my way to victory as I exploit beep 4 different ways.  Next time I try to exploit something multiple ways, I'll probably split it up in multiple videos.",
        "Method 1: LFI + Password",
        "Method 2: Turning LFI into RCE",
        "Method 3: Code exec via call",
        "Method 4: Shellshock"
      ]
    },
    {
      "name": "BigBang",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering BuddyForms on Wordpress, manually discovering the version (before this we ran WPSCAN aswell)",
        "Finding a BlogPost showing a File Disclosure Vulnerability in BuddyForms and they used a Phar Deserialization trick to get RCE but this doesn't work on PHP8",
        "Playing with the File Disclosure, using a PHP Filter Chain to prepend GIF89a to our file and show we can trick the magic byte trick",
        "Finding a Blog Post which talks about a buffer overflow in GLIBC ICONV for PHP, which shows we can get RCE on file reads up to php 8.3.7",
        "Setting up WrapWrap which is just a better way to prepend/append bytes, showing we do miss the end of the file when we use this technique",
        "Modifying the CNEXT exploit which exploits the ICONV in PHP to achieve RCE on file_get_contents",
        "Reverse shell returned! Using Chisel to setup a tunnel to the MySQL Server, so we can dump and crack the wordpress database",
        "Shell as Shawking, finding Grafana and the SQLITE Database, downloading it and cracking the password to get another user",
        "Downloading the Satellite APK File, then decompiling it to discover the HTTP Requests it makes to the server",
        "Logging into the satellite webserver"
      ]
    },
    {
      "name": "Bighead",
      "os": "Windows",
      "difficulty": "Insane",
      "techniques": [
        "Begin of Nmap",
        "Pulling important information from the website",
        "Discovering DNS Names, adding stuff to /etc/hosts",
        "Odd behavior with code.bighead.htb, redirects us to 127.0.0.1; change that with Burp",
        "Using wfuzz to dirbust, with the ability to see HTTP Codes (hunting for 418)",
        "Found BigHead Web Server on Github, pulling Zips and cracking",
        "Before reversing the binary, keep hunting for information about the OS",
        "Discovering PHPInfo within the PhpMyAdmin directory, has OS.",
        "Installing Immunity and Mona",
        "Grabbing MinGW so we can run the Bighead Webserver",
        "Crashing the webserver, seeing we have",
        "Sending a pattern to the box and examining the stack to see where our overwrites are"
      ]
    },
    {
      "name": "Bitlab",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of recon",
        "Taking a loot at the webserver and seeing a GitLab signin page",
        "Using wget and exiftool to check metadata on files on the server to see when stuff was uploaded",
        "Running gobuster, explaining why we need the Wildcard flag on this box for this tool to work",
        "Finding the /help directory which has some javascript that contains the password to GitLab",
        "Logging into Gitlab with creds from the bookmark.html",
        "Showing how to do GoBuster with a cookie (gets past the wildcard issue earlier in the video)",
        "Looking at snippets to see a Postgresql password",
        "Looking at Git Commit History of various files to see there's a post hook to upload merges to a webserver",
        "Creating a New Branch on Profile, adding a webshell, then merging it to trigger it to be uploaded to the server",
        "CMD PHP Shell is on the server, lets get a reverse shell.",
        "Reverse shell returned, setting up a proper pty with rows and cols"
      ]
    },
    {
      "name": "Bizness",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Seeing JSESSIONID and NGINX trying the off by slash exploit to get access to /manager, doesn't work here",
        "Dirbusting with FFUF because the lack of 404's messed with gobuster",
        "Discovering the OfBiz Version, looking for exploits",
        "Going over the Authentication Bypass in OfBiz",
        "Downloading YSOSERIAL and building a Docker so we don't have to worry about Java Versions",
        "Building a ReverseShell Payload that works with YSOSERIAL",
        "Reverse shell returned! Looking at OfBiz and finding out it uses the Derby Database",
        "Copy the Derby Database then using IJ from Derby-Tools to dump the data",
        "The hash in the database is a URL Base64 Encoded, decoding it reveals it has a length of 40 which is normal for Sha1Sum. Decoding it then cracking with hashcat"
      ]
    },
    {
      "name": "Blackfield",
      "os": "Windows",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Enumerating fileshares with SMBClient and CrackMapExec, highlighting some picky syntax",
        "Mounting the profiles$ directory so we can build a username list",
        "Using Kerbrute to enumerate valid usernames",
        "Running GetNPUsers to perform an ASREP Roast",
        "Checking what we can do with the Support User from the ASREP Roast",
        "Running the python Bloodhound ingestor from Linux",
        "Bloodhound ran, playing around with the data, eventually seeing support can reset audit2020's password",
        "Setting an Windows users (Audit2020) password from linux using RPCClient",
        "Audit2020 has access to the forensic share which has a memory dump of lsass, running pypykatz to extract credentials",
        "Using Evil-WinRM to access the box as SVC_Backup and discovering the backup privilege"
      ]
    },
    {
      "name": "Blazorized",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Examining the website looking for interesting functionality",
        "The check updates page loads a unique DLL and puts a JWT in the request",
        "Opening Blazorized.Helpers.Dll with ilSpy to discover a hardcoded JWT",
        "Using Burp to add the header to all of our requests and installing the Blazor Traffic Processor Plugin",
        "Examining the traffic, discovering the server instructs our client to get a JWT from localstorage",
        "Discovering MSSQL Injection in the Super Admin Panel, getting RCE",
        "Reverse shell returned",
        "Running SharpHound, then standing up a WebDAV server on nginx so we can use files back to our host over HTTP PUT Requests",
        "Starting Bloodhound discovering we can SetSPN on another user",
        "Setting the SPN on a user via Powerview, which lets us kerberoast to get a hash and cracking it"
      ]
    },
    {
      "name": "BlockBlock",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Registering an account and discovering the chat, examining source and seeing a database solidity contract",
        "Testing for XSS, discovering it within the username",
        "The /api/info page exposes the JWT, which lets us exfiltrate it even if HTTPONLY is set",
        "Using FeroxBuster to enumerate the API with different methods",
        "Discovering XSS in the Report feature, and get a hit from the admin, create a JS Payload to exfiltrate the admin token",
        "We are now the admin, which has access to a new endpoint that interacts with the blockchain via the json-rpc API playing with endpoints",
        "Playing with eth_getAccount",
        "Playing with eth_getBlockByNumber, then viewing information on the chain. Enumerating all blocks will start revealing credentials",
        "Shell on the box as Keira, can run forge as paul which we can exploit two ways",
        "Exploiting forge with path injection since the sudo has no env_reset set"
      ]
    },
    {
      "name": "Blocky",
      "os": "",
      "difficulty": "",
      "techniques": [
        "The STTY command I messed up was simply `stty rows ## cols ##`",
        "Begin Recon with Reconnoitre",
        "Examining findings from Reconnoitre",
        "Decompiling java Jar Files with JAD",
        "Using JD-GUI",
        "Running WPScan",
        "Manually enumerating wordpress users",
        "SSH To the box and PrivEsc",
        "------ Box Completed, Below extra content (Some mistakes, pretty much do this live without prep)",
        "Rabbit hole, gaining access through FTP",
        "Finding Wordpress DB Password",
        "Switching to WWW-DATA by using phpMyAdmin + Wordpress"
      ]
    },
    {
      "name": "Blue",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Start of Recon",
        "Finding NMAP Scripts (Probably a stupid way)",
        "Running Safe Scripts - Not -sC, which is default.",
        "Listing NMAP Script Categories (Prob a really stupid way)",
        "Really Cool Grep (Only show matching -oP)",
        "Nmap Safe Script Output",
        "Exploiting MS17-010 with MSF",
        "Setting up Dev Branch of Empire",
        "Starting a Listener",
        "Getting a PowerShell Oneliner to launch payload",
        "Invoke-Expression (IEX) to Execute Launcher",
        "Interacting with a single agent"
      ]
    },
    {
      "name": "Blunder",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of NMAP",
        "Discovering install.php, which says bludit is being installed.",
        "Looking for exploits searchsploit, everything requires Auth",
        "Attempting a login and noticing the CSRF Tokens",
        "Looking for exploits online that haven't made it to SearchSploit yet",
        "Placing the X-FORWARDED-FOR header to bypass brute force protection",
        "Creating a Python Brute Forcer",
        "Scripting: Grabbing the CSRF Value with python requests",
        "Scripting: Grabbing the PHP Session Cookie with python requests",
        "Scripting: Sending a login request with python requests",
        "Scripting: Telling request to not follow and detect a valid login"
      ]
    },
    {
      "name": "Blurry",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap, then gobuster to do a vhost scan",
        "Enumerating RocketChat version by looking at the version of Meteor it uses",
        "Registering for a RocketChat Account then reading the chat to get information about ClearML",
        "Logging into ClearML, looking at the project to see some scripts which are running",
        "Discovering ClearML Version in the footer of the settings page and finding public exploits",
        "Setting up the ClearML API on our box",
        "Building our script to upload a pickle artifact to ClearML And getting a shell",
        "Copying the SSH Key from the box and logging in",
        "We can run a bash script with sudo that runs a pytoch model, before doing so it uses Fickle to identify if it malicious",
        "Creating an exploit script to save a malicious pytorch file and getting a root shell",
        "BEYOND ROOT: Going into Fickling about how it works, changing our payload from os.system to subprocess.popen and seeing its detection gets less confident"
      ]
    },
    {
      "name": "Boardlight",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Running a VHOST Scan to discover CRM Subdomain",
        "Discovering Dolibarr is running at version 17.0.0 which is vulnerable to CVE-2023-30253",
        "Discovering default credentials of admin:admin work then running the exploit",
        "Using BurpSuite to act as a Transparent/In-Line proxy so we can proxy the exploit script without editing it, so we can understand what it does",
        "Manually stepping through the exploit to understand exactly what it does",
        "Reverse shell returned, dumping the local database",
        "Just trying the MySQL Password with Larissa and finding password re-use",
        "Discovering a SetUID Binary called Enlightenment_sys getting the version from dpkg and finding it vulnerable to CVE-2022-37706 and getting root",
        "BEYOND Root: Understanding how the Enlightenment_sys privesc works and doing source code analysis",
        "Discovering why the exploit uses /tmp///net"
      ]
    },
    {
      "name": "Bolt",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Examining the SSL Certificate to find alternative names",
        "Discovering PassBolt, but looks like we need an email to login to passbolt",
        "Checking the bolt.htb and finding a link to download a custom docker image",
        "Extracting the docker image and viewing the docker layers",
        "Showing off \"Dive\" which is a tool to navigate docker images",
        "Showing my initial process at analyzing this with a little bash-fu",
        "Creating a bash loop to print every file",
        "Viewing config.py, and history files by decompressing the layers they are in",
        "Viewing information in the SQL Lite Database and grabbing a password hash",
        "Logging into the web app"
      ]
    },
    {
      "name": "Book",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Begin of Recon",
        "Enumerating the login page",
        "Creating an account, identifying what fields are unique",
        "Logged into the page, examining functionality starting with the download.php file",
        "Playing with the search field",
        "Playing with XSS by using img src",
        "Examining the user signup more closely",
        "Viewing javascript on the page to show there is a maximum number of characters in username/email",
        "Start of attempting SQL Truncation attack",
        "Attempting to login to /admin/ with our account to see we get in, then redoing everything to explain it.",
        "Explaining the SQL Truncation Attack"
      ]
    },
    {
      "name": "Bookworm",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering a potential XSS in the Notes field of an order. Content Security Policy (CSP) blocks us, because JS cannot be on the same page. Looking for a file upload functionality.",
        "Finding out we can upload anything we want to the avatar. This should allow us to bypass the CSP in the book edit field",
        "Confirmed XSS on the page, checking if there's an IDOR Vulnerability that allows us to add notes to other people's items by creating a second account",
        "Creating a Python Script that will automatically poison items in peoples basket (cart)",
        "Backet Poisoner script is completed",
        "Creating a JavaScript payload, explaining why I'm doing await, fetch, and helper functions.",
        "Having the XSS Payload fetch profile, look for orders, then perform a get on all orders to examine the order page.  Then send us the HTML of that page",
        "Creating a Python Flask Server that will save all of the orders the XSS Payload sends us",
        "Examining orders, discovering there is a \"Download Everything\" URL. Didn't show it but there is no IDOR Vulnerability here, need to have the XSS Trigger it. Exfilling /etc/passwd",
        "Extracting database.js, which contains the database information. The password lets us onto the system as Frank"
      ]
    },
    {
      "name": "Bounty",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Begin of recon",
        "Gobuster, using -x aspx to find aspx pages",
        "Playing with a file upload form, seeing what can be uploaded",
        "Using Burp Intruder to automate checking file extensions",
        "Finding a way to execute code from file upload in ASPX (web.config)",
        "Executing code via web.config file upload",
        "Installing Merlin to be our C2",
        "Compiling the Merlin Windows Agent",
        "Modifying web.config to upload and execute merlin",
        "Merlin Shell returned!",
        "Checking for SEImpersonatePrivilege Token then doing Juicy Potato",
        "Getting Admin via Juicy Potato"
      ]
    },
    {
      "name": "BountyHunter",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Running nmap, doing all ports and min-rate",
        "Poking at the website to discover a static site",
        "Starting up a gobuster to do some recon in the background",
        "Discovering log_submit, and finding out it is vulnerable to XXE (XML Entity Injection)",
        "Verified it is vulnerable to XXE, attempting to extract a file",
        "Chaining a PHP Filter to convert files to base64, which lets us avoid bad characters and leak source",
        "Start of coding out a program to automate this LFI",
        "XXE LFI POC Done, improving it by adding the cmd module",
        "Reading source code of pages, getting nothing",
        "Finding db.php from out gobuster, leaking the source and getting a password",
        "Grabbing /etc/passwd in order to build a userlist to password spray"
      ]
    },
    {
      "name": "Brainfuck",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Start of WP Hacking",
        "Logged into WP",
        "Login to SuperSecretForum",
        "Cracking the SSH Key",
        "Begin of getting root.txt (RSA Cracking)",
        "http://rumkin.com/tools/cipher/ -- Site used to during the SecretForum stuff."
      ]
    },
    {
      "name": "Breadcrumbs",
      "os": "Windows",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Poking at the website",
        "Quickly testing for SQL Injection and coming up with nothing",
        "Creating an account and checking what regular users can do",
        "Using BurpSuite Sequencer to identify low entropy within login cookies",
        "Finding the 302 redirect still outputs the page, its just that the browser doesn't want to show it",
        "Creating a simple PHP File to be uploaded",
        "Finding the /books/ url and checking the book search page again to find LFI",
        "Building a quick python script to automate the LFI",
        "Windows is really weird with SSH, need to disable PubKeyAuth in order to login with a password",
        "Looking at the fileController php file to see who can upload files"
      ]
    },
    {
      "name": "Broker",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Logging into ActiveMQ with admin:admin and then failing to use the exploit from 2016",
        "Doing a full nmap scan, then running script scans on the open ports",
        "Finding a page that talks about CVE-2023-46604, the latest activemq exploit",
        "Pulling down an exploit payload for this exploit, it is golang",
        "Modifying the payload to execute a reverse shell, instead of downloading and executing an elf file. Need to HTML Entity Encode the payload",
        "Reverse shell returned, seeing we can run nginx as root",
        "Building an nginx config that runs as root and shares the entire filesystem",
        "Enabling the WebDav PUT so we can upload files to the server and uploading an SSH Key",
        "Showing we could upload a cron entry aswell to get code execution"
      ]
    },
    {
      "name": "BroScience",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Finding some vulnerable-looking parameters",
        "Testing some basic things for LFI, finding a WAF blocking ../.  Double encoding it to get passed",
        "Start of writing a script to abuse this LFI and crawl/download all the php source",
        "Making the script recursive, so it will check pages downloaded for new links",
        "Making the script save the files",
        "Opening the code in Visual Studio Code, and showing off Snyk's static code anlysis to highlight a Unserialization vuln",
        "Identifying how the site generates activation codes upon registration identifying an insecure use of SRAND(). Generating our own activation code",
        "Exploiting the PHP Unserialization by finding a vulnerable gadget (wakeup) which will save a file",
        "Building a deserialization object to download a file off our server and write it to the web directory",
        "EDIT: Talking about webserver hardening (allow_url_fopen in php) and how it would slow down this attack"
      ]
    },
    {
      "name": "Bucket",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap discovering the HTTP Site bucket.htb",
        "Poking at the website, using the developer console to discover s3.bucket.htb",
        "Using curl to view HTTP Headers and discovering amazon",
        "Oh god... I forgot to edit the URL in this gobuster! Actually created a feature request in GoBuster to fix this mistake from happening.",
        "Installing AWS CLI",
        "Using the aws to connect to a custom endpoint, then configure credentials",
        "Exploring the S3 Bucket",
        "Using S3 to add a reverse shell to the website",
        "Reverse Shell returned, spending some time to start taking notes.",
        "End of notes, poking around on the terminal to find",
        "Discovering some weird ports, checking the apache configuration to see if they are related"
      ]
    },
    {
      "name": "Buff",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Introduction",
        "Begin of nmap and poking at the website",
        "Checking when an image was uploaded to the server with wget and exiftool",
        "Contact.php discloses the software Gym Management Software is being used.  Examining the exploit",
        "Editing the Python Exploit to force everything through a proxy, so we can examine what the exploit does.",
        "Running the exploit and examining in Burp",
        "Having trouble getting a reverse shell via PS, Uploading NC.EXE to do it",
        "Running WinPEAS.exe",
        "Discovering CloudMe in the Downloads directory then looking at the exploit",
        "CloudMe isn't listening on a port... Reverting and getting a shell again",
        "Reverse shell returned... Still waiting for CloudMe to listen on a port",
        "Uploading Chisel to the box, then doing a port forward for MySQL to enumerate the database"
      ]
    },
    {
      "name": "Builder",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Looking at Jenkins Advisory 3314 (CVE-2024-23897), which has a File Read vulnerability in the CLI. Then downloading the Jar",
        "Explaining the Vulnerability with a quick demo",
        "Creating a really nasty bash script to fuzz many of the Jenkins Paramaters to see which produce the most number of lines",
        "Script working, discovering which commands let us export the entire passwd file",
        "Using docker to pull the latest version of Jenkins, in order to see how it stores credentials",
        "Extracting the Password Hash for Jennifer and cracking it to get logged into Jenkins",
        "Showing Jenkins Script Console, a fun way to get code execution on Jenkins. But this isn't the path",
        "Going into the Credentials Store for Jenkins, discovering a SSH Key is there. Exporting it and then using the Script Console to decrypt it",
        "Flailing around, trying to export all the secrets needed to decrypt the SSH Key... Don't get it working unfortunately but thought it was good to leave in here.",
        "Exporting the SSH Key through a Jenkins Pipeline"
      ]
    },
    {
      "name": "Busqueda",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of the nmap",
        "Copying the request in burpsuite to a file so we can use FFUF to fuzz",
        "Just testing for SSTI",
        "Found two bad characters, putting a comment after a bad character to see where it is failing",
        "Discovering we can append to the string, then trying for executing code with print to test for eval statements",
        "Getting a reverse shell",
        "Reverse shell returned",
        "Looking at apache virtualhosts to discover a hidden vhost that is running gitea",
        "Finding creds in the .git folder which lets us run sudo",
        "Inspecting the docker containers to discover passwords in environment variables which lets us log into gitea as administrator and view the script we are running as sudo",
        "Discovering the system-checkup.py script is not using an absolute path, so we can execute a shell script in our CWD as root"
      ]
    },
    {
      "name": "Cache",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Running NMAP and checking out the page",
        "Author page contains a hint to do some type Domain Brute Forcing",
        "The Login form won't go to burpsuite, lets check out javascript",
        "Doing VirtualHost (VHOST) Bruteforcing with GoBuster to discover hms.htb",
        "Discovering OpenEMR, running searchsploit, attempting to find the version of it",
        "Searchsploit doesn't have any exploits, checking one on google to find a SQL Injection",
        "Discovering error based SQL Injection (XPATH)",
        "Manually extracting data from error based SQL Injection (XPATH)",
        "Using BurpSuite Intruder to aid us in running a bunch of SQL Injections, incrementing a number to get all the fields",
        "XPATH Injection only extracts 32 characters, we need to use SUBSTRING to extract fields longer than 32",
        "Logging into OpenEMR then using file upload functionality to upload a webshell"
      ]
    },
    {
      "name": "Calamity",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Blog Post: https://reboare.github.io/lxd/lxd-escape.html",
        "Begin of recon",
        "admin.php discovered, finding the pw",
        "Getting Code Execution",
        "Finding out why Reverse Shells weren't working",
        "Getting a reverse shell by renaming nc",
        "Transfering files via nc",
        "Opening the wav file",
        "Using audiodiff to identify differences in sound",
        "The next step, why is the same song there twice?",
        "Importing files into Audacity and Inverting"
      ]
    },
    {
      "name": "Canape",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of Recon, nmap and poking around the website",
        "Dirbusting a site that always respond 200",
        "Switching to a different Wordlist (SecLists/Discovery/Web/Common)",
        "Discovery of .git - Poking around to clone it and download",
        "Downloaded .git, examining commit history",
        "Start of Pickle Talk",
        "Begin writing of the pickle exploit",
        "Return of Reverse Shell as www-data",
        "Begin looking into CouchDB",
        "Poking around at documents within CouchDB",
        "Examining first exploit with creating a CouchDB User",
        "Exploring the passwords database with our newly created admin user and finding Homers Password."
      ]
    },
    {
      "name": "Cap",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of nmap and doing some recon against FTP",
        "Having trouble finding a release date, using WGET and examining metadata to see how old a page is",
        "Examining the web applicaiton",
        "Testing and finding the IDOR Vulnerability",
        "Examining the PCAP Downloaded through the IDOR Vulnerability to find FTP Creds",
        "SSHing into the box with the credentials from FTP",
        "Running LINPEAS, examining the source code of the webapp while it runs",
        "Going over the LINPEAS output finding python has the ability to setuid",
        "Using the os libary to setuid to root",
        "Showing off zeek which would help analyze larger pcaps",
        "Changing the Zeek FTP Configuration to show passwords."
      ]
    },
    {
      "name": "Caption",
      "os": "",
      "difficulty": "",
      "techniques": [
        "** See Pinned Comment for Root Shell.",
        "Introduction",
        "Start of nmap",
        "If you want to learn more about Varnish check out Forgot",
        "Looking at the Git Repo, discovering the Infra stack HAProxy, Varnish, Flask",
        "Discovering Margo's password in an old commit",
        "Testing if we can put a line break in the URL to bypass HAProxy's ACL (like in Skyfall)",
        "Using H2CSmuggler to use an HTTP2 upgrade to bypass the HAproxy ACL",
        "Poisoning the cache and placing an XSS Payload in the UTM_Source Tracker",
        "Got an Admin Cookie, using it to access the logs page via h2csmuggler",
        "Looking at the logs, showing there's an ecdsa key that margo uses",
        "Googling the URL we downloaded the logs from discovering its copyparty which has a file disclosure exploit"
      ]
    },
    {
      "name": "Carpediem",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Nmap the box, examining server banners",
        "Checking out the website, doesn't seem like anything special",
        "Using Ffuf to perform a virtual host scan to discover other subdomains and find portal",
        "Discover the Motorcycle Store Portal. Trying to play with a potential LFI but deciding it may be a rabbit hole",
        "Stop of examining rabbit hole.",
        "Registering an account and noticing it goes to an API.  Lets test the API Out by fuzzing other functions",
        "Running a GoBuster on the classes directory to find more controllers for the API",
        "Fuzzing the Users.php file for more functions and discovering Upload",
        "Using OpenAI to generate an HTML Upload form, so we can see create an HTTP Upload Request",
        "Pasting our upload request and uploading a webshell",
        "Showing a SQL Injection in the Login Function that is vulnerable to Mass Assignment"
      ]
    },
    {
      "name": "Carrier",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of Recon",
        "Checking out the Web Page",
        "Doing UDP/GoBuster Scans",
        "Running SNMPWalk and then logging into web interface",
        "Reading the tickets on the web page",
        "Discovering code execution",
        "Reverse Shell Returned",
        "Discovering FTP Server 10.120.15.10",
        "Gaining access to a Router Interface",
        "Using Draw.io to draw out the network",
        "Examining routing information",
        "Looking at BGP Information"
      ]
    },
    {
      "name": "Cascade",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Begin of nmap",
        "Enumerating RPC to identify usernames",
        "Setting up a bruteforce and creating a custom wordlist with hashcat",
        "Enumerating LDAP with LDAPSEARCH",
        "Discovering the cascadeLegacyPwd LDAP Attribute which has a password",
        "Using CrackMapExec to test the credential found in LDAP",
        "Installing the latest CrackMapExec to gain access to the Spider_Plus Module",
        "Using the spider_plus module of CME (CrackMapExec) to crawl the SMB Share as R.Thompson",
        "Mounting the SMB Share as R.Thompson in order to view the files in Data share",
        "Discovering the VNC Install.reg file which contains an encrypted password",
        "Using Metasploit IRB to decrypt TightVNC's password"
      ]
    },
    {
      "name": "Cat",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Taking a look at uploads at the website starting with upload functionality",
        "Discovering .git directory, using git-dumper to grab the source and examining the code behind upload to see it is likely not vulnerable",
        "Testing for XSS in username, getting admin cookie upon submitting a cat to the site",
        "Showing another way to do XSS Bypassing a filter via HTML Entity Encoding",
        "Analzying the code with Snyk and OpenGrep to find vulnerabilities and discovering SQL Injection",
        "Using SQLMap to dump the database via a boolean injection which is slow",
        "Showing we could manually exploit it quickly by dropping a file via sqlite injection",
        "Using SQLDump to dump hashes, then sending them to crackstation to get rosa's password",
        "Discovering the application does logins via GET which would put passwords in a log file, rosa is a member of ADM and can read logs.",
        "Logging in with Axel, discovering Gitea is running and setting up a port forward"
      ]
    },
    {
      "name": "Catch",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap, going over some standard cookies and knowing the web technology behind it",
        "Checking what the main webpage is, discovering an APK File",
        "Analysing the APK file with JADX-GUI",
        "Searching for strings, finding some tokens",
        "Looking at the Gitea API to discover how to use our token",
        "Looking at the Lets Chat API to discover how to use our token and dumping a list of rooms",
        "Using the Lets Chat API to dump messages from a room and discovering credentials",
        "Logging into the Catchet webserver finding the version and discovering known vulnerabilities",
        "Using a CVE-2021-39174 POC to dump the Catchet Configuration and get a password (SSTI)",
        "Logging into the box as will",
        "Discovering a verify.sh script that has a command injection when verifying APK Files"
      ]
    },
    {
      "name": "Celestial",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of Recon",
        "Looking at the web application and finding the Serialized Cookie",
        "Googling for Node JS Deserialization Exploits",
        "Start of building our payload",
        "Examining Node-Serialize to see what the heck _$$ND_FUNC$$_ is",
        "Moving our serialized object to \"Name\", hoping to get to read stdout",
        "Really busing the deserialize function by removing the Immediately Invokked Expression (IIFE)",
        "Failing to convert an object (stdout) to string.",
        "Verifying code execution via ping",
        "Code execution verified, gaining a shell",
        "(Get a shell via NodeJSShell at end of video)",
        "Reverse shell returned, running LinEnum.sh"
      ]
    },
    {
      "name": "Cerberus",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Looking at the TTL of Ping to see its 127, then making a request to the webserver and seeing it is 62",
        "Showing DNS is listening on Cerberos and exposing the 172.16.22.0/24 network",
        "Looking at Icinga, testing default credentials",
        "Fingerprinting the Icinga release by looking at javascript, using UI.JS since it looks like it changes frequently",
        "Cloning the repo, then writing a one-liner to hash all versions of ui.js and finding which commit the version off the webserver is on",
        "Finding a File Disclosure vulnerability in Icinga CVE-2022-24716, leaking some Icinga configuration files and finding a web users password",
        "Gaining RCE via CVE-2022-24715, which allows us to write a file to disk then change where the Icinga plugin directory is to get code execution",
        "Shell as www-data, doing some basic recon to figure out what type of virtual environment we are in via /sys/class/dmi/id/sys_vendor",
        "Looking at running processes and seeing sssd is running which allows this box to talk to the domain",
        "Looking at SetUID Files, discovering FireJail and privesc'ing CVE-2022-31214"
      ]
    },
    {
      "name": "Cereal",
      "os": "Windows",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap, showing having valid hostnames will give more information",
        "Error message on source.cereal.htb leaks a path",
        "Showing .git doesn't exist in DirectyList but does in Raft",
        "Using Git-Dumper to download the .git directory and view the source",
        "Looking at Git History shows where deserialization happens and a hard coded JWT",
        "Using the hard coded JWT To build our own token in dotnet.",
        "Trying to use our JWT to access authenticated pages",
        "Going through the React JavaScript to see the token is stored in our browsers local storage",
        "Our browser keeps clearing the storage lets just intercept a request in BurpSuite and do what we need",
        "Start of the Desrialization, BadWords Filter to prevent ySoSerial, but we can manually create our own deserialization payload",
        "Finding the name of our JSON Library then finding a blackhat talk on abusing it, to build our payload",
        "More examining javascript to find routes that leaks pages of the pplication"
      ]
    },
    {
      "name": "Certificate",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Checking out the website and registering a user",
        "Discovering upload functionality, that lets us upload PHP Files. Explaining what a Null Byte will may do in a zip file",
        "Using BurpSuite to manipulate the hex and add a Null Byte in the filename shell.php..pdf, so when unzipped it becomes shell.php",
        "Talking about the Zip Stack or Concatenation Attack, where we stack two zips on top of eachother. Some Zip Programs read he first file, others read the second",
        "Shell on the box, dumping hashes out of the database and cracking hashes",
        "Getting a Shell as Sara.B, discovering a PCAP which contains a Kerberos Auth. Extracting the Hash and cracking (krb5pa)",
        "Shell as Lion.SK, looking at groups and also running RustHound to see we have permissions to a Certificate",
        "Running Certipy to list vulnerable certificates which shows ESC3, we can't request Administrator because it lacks an email address",
        "Running some powershell commands to look at groups and members of groups to discover Ryan.K has storage permissions, using ESC3 to get his account",
        "Exploiting SeManageVolumePrivilegee and then extracting the CA Certificate to perform Golden Ticket attack to forge a ticket from Administrator"
      ]
    },
    {
      "name": "Certified",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap discovering only Active Directory (AD) Related ports",
        "Running Certipy both with and without the vulnerable flag",
        "Outputting Certipy to JSON and then writing a JQ Query that will show us non-default users that can enroll certificates",
        "Explaining the JQ Query that will take the list, filter out specific words, then show us items that still have an item",
        "Running Bloodhound.py to get some bloodhound data",
        "Looking at what Judith can do in Bloodhound, showing discovering by clicking outbound permissions",
        "Certipty gave us a high value target, can also use bloodhound to show us a path to the high value target which involves WriteOwner, GenericWrite, and GenericAll",
        "Abusing WriteOwner with owneredit, allowing us to add members with dacledit, and then taking ownership and then adding ourself to the group",
        "Using Certipy to abuse GenericAll/GenericWrite to create a shadow credential and grab the NTLM Hash",
        "Going over ESC9",
        "Using Certipy to exploit ESC9, updating UPN, requesting cert, updating UPN, and then using the certificate"
      ]
    },
    {
      "name": "Chainsaw",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of recon",
        "Downloading and analyzing the files off the anonymous FTP Directory",
        "Looking into solidity to see what these files are about",
        "The full portscan finished, trying to find out what port 9810",
        "Recommended reading to understand blockchain fundamentals",
        "Begin writing the script to interact with the smart contract",
        "Calling the getDomain function, then setting the domain to our IP and seeing the ping",
        "Command injection found, getting a reverse shell via bash",
        "Checking the source code to see why this worked",
        "Looking into what IPFS is (found in administrators home directory)",
        "Running ipfs refs local to list all files",
        "Dropping a SSH Key so we can get off this reverse shell"
      ]
    },
    {
      "name": "Chaos",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of recon",
        "Starting up GoBuster then editing /etc/hosts to add the hosts in nmap",
        "Going over the website",
        "Discovering a wordpress instance (/wp/ form goBuster)",
        "Finding webmail credentials from a wordpress Protected Post",
        "Discovering webmail.chaos.htb (Method 1)",
        "Testing IMAP, then configuring Evolution to login to the mail server (Method 2)",
        "Decrypting the message that was in the draft.",
        "Message decrypted, new page discovered",
        "Discovering a webpage for creating pdfs",
        "Searching for a code injection path for LaTex",
        "Discovering the blacklist is on \"input\""
      ]
    },
    {
      "name": "Charon",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Rabbit Hole - Searching for SuperCMS",
        "Running enumeration in the background (GoBuster)",
        "Rabbit Hole - SQLMap Blog SinglePost.php",
        "Finding PHP Files in /cmsdata/ (GoBuster)",
        "Manual Identification of SQL Injection",
        "SQL Injection Explanation",
        "Rabbit Hole - Starting SQLMap in the Background",
        "SQL Union Injection Explanation",
        "Identifying \"Bad/Filtered Words\" in SQL Injection",
        "SQL Union Finding number of items returned",
        "Returning data from Union Injection",
        "SQL Concat Explanation"
      ]
    },
    {
      "name": "Chatterbox",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Begin of Recon",
        "Start of aChat buffer Overflow: Finding the exploit script with Searchsploit",
        "Begin of replacing POC's Calc Shellcode with what is generated from MSFVenom",
        "Correction: Payload Size wrong, should be 3,xxx -- look at \"Payload Size\" I accidentally highlighted the size of the python file.",
        "Whoops, erased too much out of POC.  Lets correctly replace the shellcode this time and get a shell.",
        "Running PowerUp to find AutoLogon Credentials",
        "Running Code as Administrator",
        "First Privesc Method: Using Start-Process to execute commands as a different user because Invoke-Command did not work.",
        "Alternate way to read root.txt -- Alfred owns root.txt, so he can edit the files access list. Get-ACL to view access list and cacls to modify",
        "Summary of the box",
        "### BOX DONE",
        "Doing the box with Metasaploit, Warning: Lots of fails."
      ]
    },
    {
      "name": "Checker",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Enumerating version of Bookstack by the HTML Source, it's part of the CSS Include",
        "Enumerating Teampass version by looking at github, discovering changelog.txt",
        "Looking at vulnerabilities in Teampass finding an SQLInjection on cvedetails",
        "Examining the SQL Bash Script, having it go through burp so we can inspect it",
        "Logging into Teampass and getting credentials to SSH and Bookstack",
        "Going back to Bookstack, looking at the SSRF Vulnerability",
        "Changing an SSRF in PHP to File Disclosure by using Filters",
        "Updating the PHP Filter Chain Oracle script and then running it to leak files",
        "Leaking the Google Authenticator seed and logging into SSH",
        "Extracting the server time from HTTP Headers so we can sed MFA Seed correctly"
      ]
    },
    {
      "name": "Chemistry",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction shorter than normal since I did this blind",
        "Start of nmap",
        "Looking at the webpage, see CIF Analyzer",
        "Finding an exploit script, testing out with ping and getting a ping",
        "Having trouble getting a reverse shell, end up curling a file",
        "Reverse shell returned, playing around with the shell to try and figure out what happened",
        "Finding another webserver listening on 8080,  can't access it",
        "Dumping the database, finding some other credentials",
        "Logging in as Rosa, my host didn't allow SSH Commandline, fixing it. Can now access port 8080",
        "Finding an oldversion of aiohttp 3.9.1 is running, that is vulnerable to path traversal, grabbing the root ssh key",
        "Showing the iptables rule that blocks a specific user from sending packets"
      ]
    },
    {
      "name": "Cicada",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Running NetExec discovering an open share (HR), which contains a password for new hires",
        "Using NetExec to list accounts via RID Brute Force and explaining how it works under the hood with RPCLient",
        "Some VIM-Fu to convert the NetExec output to show only a list of users and performing a password spray",
        "Gaining access to David Orelious, which has access to the Dev Share which has the password of another user",
        "Shell as Emily with WinRM, discovering the SeBackup privileges, looking up how to abuse this",
        "Using Reg Save to backup the SAM and SYSTEM Hive, and then extracting administrator password from it, which gives root",
        "Showing we could also backup the NTDS.DIT with RoboCopy",
        "Talking about the Impacket Reg.Py script and showing we could try to backup the registry directly to our box, but the file transfer is unreliable"
      ]
    },
    {
      "name": "Clicker",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap and discovering NFS, which is hosting source code to the webserver",
        "Showing off the NFSClient Golang binary by Mubix, does not work here because NFS is Read-only",
        "Viewing the website for the first time, so we have an idea of what source code we are looking at",
        "Looking at the source code, Snyk doesn't give us anything",
        "Looking at database queries and finding a Mass Assignment Vulnerability",
        "Discovering we need to assign ourselves to Admin",
        "Using a line break, to bypass the check against the Key, allowing us to pass in the Role",
        "Showing another way to set our Role To Admin through SQL Injection in the Value",
        "Viewing the Administration page, discovering how the export function works",
        "We can place PHP Code in NICKNAME for our user, which then the export function writes to a php file which then executes",
        "Running LinPEAS, discovering a SetUID Binary (execute_query)"
      ]
    },
    {
      "name": "Code",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Navigating to the page and discovering we can run Python Code but there is a filter blocking certain words",
        "Walking through filter evasion with python, showing loaded classes",
        "Calling popen to run a command",
        "Using List Comprehension in python to convert our multiline payload into a single line",
        "Looking at the database, grabbing the hash, cracking and switching users",
        "We can use sudo to run backy.sh with task.json, looking at the bash script to see we have a way to bypass the filter",
        "Having trouble exploiting out of a temp directory, will explain later",
        "Copying task.json to a different directory and it magically works",
        "Explaining why we couldn't do this in a temp directory, sticky bit makes it a protected file!",
        "Showing another way to root it, just ignore the ../ replacement and since bash continues on error by default it still works"
      ]
    },
    {
      "name": "CodePartTwo",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Website is opensource, taking a look at the source code",
        "The website uses js2py and the version running is vulnerable to CVE-2024-28397, which is a sandbox escape",
        "Shell returned on the website, dumping the SQLite database to get Marco's password",
        "Marco can run npbackup-cli via sudo, looking into it briefly",
        "Backing up and restoring the root directory"
      ]
    },
    {
      "name": "Coder",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Exploring the file share",
        "Finding Encrypter.exe, which is a dotnet encrypter.  Discovering the seed is based upon time, modifying it to decrypt using metadata from the encrypted file to get the seed.",
        "The encrypted file was a Keepass Database, looking into it and seeing credentials and a uthenticator backup",
        "Installing the \"Authenticator\" app and seeing the backup format is the same",
        "Explaining why we want to just bruteforce AES vs Argon2id",
        "Creating a program in javascript to bruteforce the AES by decrypting and examining the contents of what was decrypted",
        "Cracking program done, then logging into TeamCity",
        "We can't modify the files on TeamCity but we can use the personal build, supply a dif and get it to execute code that way",
        "Defender blocked nishang reverse shell, doing some quick obfuscation to bypass defender and get a shell",
        "Discovering Teamcity keeps track of personal builds, looking at old ones and discovering powershell credentials.  Decrypting the Secure String to get e.black's password"
      ]
    },
    {
      "name": "Codify",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Playing with the Javascript Editor, discovering filesystem calls are blocked",
        "Discovering the sandbox is vm2, going to github discovering it is discontinued with known security issues",
        "Getting code execution, then a reverse shell",
        "Discovering a second website with a database, cracking hashes in the database",
        "Discovering Joshua can run a bash script with sudo",
        "Looking at the Bash Common Pitfall guide which shows the error in the if/then logic in the bash script",
        "Explaining why the bash if/then is exploitable when user input is on the right side and unquoted",
        "Bypassing authentication in the script with a *, then looking at processes and seeing mysql censored the password on ps",
        "Running pspy which will grab the cmdline arguments before mysql has a chance to rewrite argv",
        "Showing HIDEPIDS in /etc/fstab to hide processes of other users"
      ]
    },
    {
      "name": "Compiled",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Entering our IP Address into the website and viewing the request within NC to see the useragent (git/2.45.0.windows.1)",
        "Going over CVE-2024-32002 which is a RCE within Git on case insensitive file systems",
        "Creating the malicious git project",
        "Our exploit didn't work, editing the post hook to be a base64 encoded powershell reverse shell",
        "Reverse shell returned downloading the Gitea database",
        "Looking at how gitea formats the PBKDF2 hash, converting it to a hashcat format",
        "Creating a python script to dump hashes from a gitea database in hashcat format",
        "Shell as Emily, discovering Visual Studio version",
        "Going over CVE-2024-20656 which is a privesc within Visual Studio",
        "Going over the code, editing it to send us a reverse shell"
      ]
    },
    {
      "name": "Compromised",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap, discover web and ssh.  Discover litecart, fail to find a way to identify version",
        "Running GoBuster to find the backup directory",
        "Examining the tar archive",
        "Talking about the unix time being 32-bit timestamps but tar did not keep entire timestamp",
        "Using find with printf to sort files by modified time",
        "Discovering the admin/login.php file was modified to drop the credentials to disk",
        "Logging into LiteCart as admin",
        "Finding exploits on searchsploit, then manually running through the exploit because its Python2 with some annoying libraries",
        "Uploading our PHP Shell but it doesn't work, checking for PHP Disabled functions by using a simple php file.  Then doing phpinfo() to see other functions",
        "Running through Chankro even thoe it wouldn't work.",
        "Uploading large binary files in BURPSUITE by pasting base64 and decoding it within burpsuite"
      ]
    },
    {
      "name": "Conceal",
      "os": "Windows",
      "difficulty": "Hard",
      "techniques": [
        "Begin of recon",
        "Checking SNMP with snmpwalk",
        "Discovering a Hashed PSK (MD5) in SNMPWalk, searching the internet for a decrypted value",
        "Getting more SNMP Information with snmp-check",
        "Going over UDP Ports discovered by snmp-check",
        "Running ike-scan",
        "Examining ike-scan results to build a IPSEC Config",
        "Installing Strongswan (IPSEC/VPN Program)",
        "Adding the PSK Found earlier to /etc/ipsec.secrets",
        "Begin configuring /etc/ipsec.conf",
        "Starting and debugging ipsec",
        "Explaining why we add TCP to strongswan config"
      ]
    },
    {
      "name": "Control",
      "os": "Windows",
      "difficulty": "Hard",
      "techniques": [
        "Begin of nmap",
        "Checking out the webpage, notice an IP in the comments and run GoBuster to discover /uploads/.  Run GoBuster on /uploads/ looking for PHP files",
        "Begin fuzzing Proxy Headers with wfuzz to access admin.php",
        "Using Python's netaddr to generate an IP List based upon subnet, discovering X-Forwarded-For: 192.168.4.28 allows access to admin.php",
        "Having BurpSuite automatically add the x-forwarded-for header to our requests",
        "Explaining a reason why this header exists in the first palce",
        "Discovering Union injection on the admin page",
        "Telling SQLMap to run in the background, while we manually enumerate this ourselves.",
        "Using Group_Concat to return multiple rows in a union injection and enumerate the INFORMATION_SCHEMA Database",
        "Using LOAD_FILE and TO_BASE64 in our SQL Injection to extract source code from the webserver",
        "Enumerating who has the FILE privilege in the database, showing SQLMAP gives us some bad info"
      ]
    },
    {
      "name": "Corporate (FIXED)",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Sorry for the double upload. The last 45 seconds were missing from the first video.",
        "Introduction",
        "Start of nmap",
        "Playing with the Agent Chat, discovering we can send HTML then testing for XSS then seeing CSP (Content Security Policy) Stops us",
        "Testing for the ability to perform redirection via HTML via meta refresh",
        "Discovering the 404 error page has reflective XSS, but CSP Blocks us from running XSS on the page itself",
        "Finding one of the Analytics JavaScript Files allows for reflective injection, allowing us to insert javascript",
        "Having a Meta Redirect to the double reflective xss injection and stealing a cookie",
        "Logged into the SSO by replaying the cookie and testing password reset",
        "Getting a second session so we can test the file-sharing capability",
        "Creating a script that will enumerate users based upon the people directory, then test the welcome password",
        "Going over the internal nmap scan from the VPN"
      ]
    },
    {
      "name": "CozyHosting",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Identify JSESSIONID with nginx, but nginx appears to be configured correctly",
        "Googling the error message to identify the page uses SpringBoot, using a SpringBoot wordlist to find actuators!",
        "Using the Sessions Actuator and seeing a session for kanderson, logging in to get to the admin interface",
        "Finding RCE in the ExecSSH Page",
        "Shell on CozyHosting, looking at running services",
        "Examining the CozyHosting Jar to identify PostGres credentials then dumping the users table and cracking hashes",
        "Josh can run SSH with sudo, using proxy command to get root",
        "Explaining what ProxyCommand is"
      ]
    },
    {
      "name": "Craft",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of recon",
        "Checking out the HTTPS Certificate for potential hostnames",
        "Looking at api.craft.htb, appears to be some type of Documentation for the REST API",
        "Looking at gogs.craft.htb, no known exploits but there is some source code!",
        "Checking out the Git Issues, seeing Dinesh put a JWT Token in a comment. Checking the token out",
        "Attempting to crack the JWT (fails)",
        "Going back to the issues to see there is an eval() on user input",
        "Installing Go and Pip3 on Kali 2019.4, so we can install GitLeaks and TruffleHog",
        "Running GitLeaks and TruffleHog (find nothing) then manually analyzing the git commits",
        "Discovering Dinesh's credentials in an old git commit",
        "Logging into GOGS with Dinesh, then showing adding an SSH Key for potential port forwarding",
        "Testing Code Execution from the previous git issue, use the test.py script as a skeleton."
      ]
    },
    {
      "name": "Crafty",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Doing a full nmap scan, then scanning the minecraft ports with scripts to discover minecraft version",
        "Discovering this minecraft version is vulnerable to Log4j",
        "Extracting Java Version/Class Path/etc via Log4j",
        "Using the Log4j Shell POC to get a shell, this reflectively loads a Java Library",
        "Getting a reverse shell",
        "Discovering plugins on the server, copying the JAR over to our box and decompiling it to discover hardcoded credentials",
        "Using PowerShell to run a command as Administrator to get root"
      ]
    },
    {
      "name": "CrimeStoppers",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Begin of Recon: Getting ubuntu version",
        "Navigating to the CrimeStoppers Page",
        "First Hint - Read The Source!",
        "2nd Hint - No SQL Databases and playing with the upload form",
        "3rd Hint - Setting Admin cookie to 1 to see whiterose.txt",
        "Explanation of PHP App and why I went down testing $op parameter",
        "Testing $op parameter, another hint what year is it?",
        "Finding out $op appends .php",
        "Using php b64 filter to view php files (\"Read the source luke\")",
        "Looking into PHP Wrappers to try to gain code execution",
        "Placing our PHP Script in a zip so we can reference it with zip://, also improperly upload it to the server",
        "Attempting to use the zip:// wrapper to execute our php script, then troubleshooting the bad upload."
      ]
    },
    {
      "name": "CriticalOps",
      "os": "",
      "difficulty": "",
      "techniques": [
        "HackTheBox is running a Bug Bounty themed CTF, HackTheSystem June 27-29 2025. These challenges are all based on real bug bounty reports. There are two teaser challenges that are out now! I'll showcase",
        "HackTheSystem - Bug Bounty CTF: https://ctf.hackthebox.com/event/details/hack-the-system-bug-bounty-ctf-2508",
        "HackTheSystem Teaser Playground: https://ctf.hackthebox.com/event/details/hack-the-system-bug-bounty-ctf-playground-2509",
        "NovaEnergy Challenge w/ 0xdf:   https://www.youtube.com/watch?v=Ru5toDyKNjg",
        "Introduction",
        "Looking at the challenge description",
        "Examining the website, trying to identify how the website is configured",
        "Registering an account",
        "Playing with the ticket submission",
        "Looking into the UUID",
        "Examining the login request and noticing the server doesn't give us an auth cookie, going to the javascript source and finding a hardcoded secret value",
        "Installing the JWT Editor Burpsuite Plugin and then forging a JWT as admin"
      ]
    },
    {
      "name": "Crossfit",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Installing Obsidian which lets us take notes in Markdown format",
        "Running nmap to see FTP over SSL and it has certificates",
        "Using openssl to grab the SSL Certificate from FTP",
        "Going over the web page extracting emails, people, and user input locations",
        "Installing flameshot, which helps us take better screenshots",
        "Testing each contact form with XSS Cross Site Scripting",
        "XSS in blog-single.php Triggers an security error saying admins will be looking over our request, attempt to attack admins",
        "Putting XSS Payloads in the User Agent",
        "XSS Attempting to steal cookies with a basic payload, failing here.  Document.location is lazy, should do document.write to write an image so the user is not redirected.",
        "Using ffuf to bruteforce domains via the CORS Origin header to discover FTP",
        "XSS Using XMLHttpRequest to use the victims browser like a proxy and return web pages to us"
      ]
    },
    {
      "name": "Crossfit2",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Start of nmap and poking at website.  Browser Developer Window shows WebSockets + Hostname",
        "Setting up full portscan and gobuster while we poke at the box, to always have recon running",
        "Ussing ffuf to fuzz for emails (Forgot to set header here, we look at it later)",
        "Playing with the websockets in BurpSuite, discovering SQL Injection",
        "Creating a python program to aid our SQL Injection",
        "SQL Injection: Enumerating information_schema to pull out table information",
        "Going back to test our previous ffuf to find out i forgot the header flag",
        "Using ffuf to fuzz parameters for the passwordreset php script and trying the token from Sql Injection",
        "Enumerating our SQL Users permissions and then including files",
        "RelayD configuration shows a new domain crossfit-club.htb, failing to sign up with an account",
        "Using grep to extract /api/ endoings from javascript files"
      ]
    },
    {
      "name": "CTF",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Support me on Patreon! https://patreon.com/ippsec",
        "Start of Recon, discovering CentOS Version via HTTPD Version",
        "Checking out the HTTP Page",
        "Checking out login.php",
        "Identifying a Secure Token is used, most likely STOKEN",
        "Failing to enumerate usernames through BruteForce",
        "Fuzzing the login form with special characters to identify a blacklist",
        "Trying Double URL Encoding to bypass the BlackList",
        "Explaining Double URL Encoding",
        "Discovering this is most likely a LDAP Injection",
        "Explaining how a LDAP Query Works",
        "Identifying the LDAP Query Structure with a Null Byte"
      ]
    },
    {
      "name": "Curling",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Begin of Recon",
        "Running Cewl to generate a wordlist",
        "Finding secret.txt in the HTML Source, which happens to be the password",
        "Runninh JoomScan so we have something running in the background",
        "Checking the manifest to get the Joomla Version",
        "Explaining what equals mean in base64",
        "Begin of hunting for Joomla Username",
        "BruteForcing Joomla Login with WFUZZ",
        "Troubleshooting by sending wfuzz through burp",
        "Turns out the CSRF Token is tied to cookie, adding that to the wfuzz command",
        "Success! Logged into Joomla",
        "Gaining code execution by modifying a template"
      ]
    },
    {
      "name": "CyberMonday",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap, playing with the webapp discovering it is Laravel PHP App",
        "Discovering /assets is a redirect to /assets/, indicator of the Nginx off by slash [MasterRecon]",
        "Using the Nginx off by slash to download .env and .git to get the source code to the app",
        "Start of code analysis",
        "Finding a Mass Assignment vulnerability in the update functionality",
        "Taking some time to explore if there are ways to find Mass Assignment without looking at the code or guessing",
        "Looking at the Webhooks-api-beta website, playing with the request and discovering we need to send it JSON",
        "Playing with the JWT, Discovering its a RS256 encoded, doing an Algorithm Confusion attack to sign the token with the RSA Public Key",
        "Playing with the Webhook and discovering a SSRF, which we can also do protocol smuggling since we can write to the HTTP Method",
        "Looking at the Redis Migrate functionality which confirms we can interact with Redis. Also stand up redis on our box with docker",
        "Inserting a poisoned laravel cookie into redis we created with phpggc, troubleshooting all the encoding issues we have. Browsing the page deserializes our cookie and gets RCE"
      ]
    },
    {
      "name": "Cypher",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Sending a single quote in login and causing an error that has a stack trace tied to it, can see the cypher query it is running",
        "Forcing the Cypher Query to return true creating an authentication bypass in cypher queries",
        "Also showing we can exfiltrate data through out of band injection with LOAD CSV in cypher queries",
        "Playing around with the neo4j database by running cypher queries",
        "Discovering a custom function getUrlStatusCode, finding the java source code and finding an RCE via command injection",
        "Getting a shell on the box by exploiting the custom function, finding a neo4j password that gets us the GraphASM User",
        "Also showing the /api/cypher endpoint didn't require authentication",
        "Finding out GraphASM can run bbot with sudo, showing we can leak partial files by just putting the file as a target",
        "Getting RCE by creating a malicious config that lets us load a custom bbot module"
      ]
    },
    {
      "name": "Dab",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Begin of the box",
        "Checking the HTTP Ports out",
        "Using wfuzz to bruteforce a login on port 80",
        "Begin examining port 8080, use wfuzz to bruteforce a cookie",
        "Using wfuzz to enumerate the WAF and determine bad characters",
        "Doing a SSRF Like attack with wfuzz and enumerating open ports on localhost.",
        "Begin examining port 11211 (MemCache)",
        "Dumping data from Memcache",
        "Using CVE-2018-15473 to enumerate valid users over SSH",
        "Cracking the users hash and logging into the box",
        "Using R2 to analyzing rabbit hole application \"try_harder\"",
        "Going through LinEnum"
      ]
    },
    {
      "name": "DarkCorp",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering the Contact Us form lets us send emails anywhere, also leaks the bcase user to the recipient",
        "Discovering RoundCube Version and finding it is vulnerable to XSS, testing it against ourself with the contact us form",
        "Building a XSS CSRF Payload that will exfil all emails in the inbox",
        "Creating the Python HTTP Server to display emails sent from the XSS Payload, use Beautiful Soup to parse the HTML to only show important pieces",
        "Sending the XSS to bcase, getting his emails. Discovering a new subdomain, using password reset and reading his inbox again to discover the reset link",
        "Finding SQL Injection in PostGres, checking if we are super user, discovering there is a filter stripping the work copy",
        "Doing some light evasion using an eval like feature of PostGres so we can encode our query and getting a shell on the box",
        "Discovering an encrypted file, using the db password within .env of the webapp to decrypt it",
        "Getting our first Active Directory user, running RustHound but there aren't many paths",
        "Logging into another page with Victor's credentials, we have an SSRF here"
      ]
    },
    {
      "name": "Delivery",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Starting with nmap",
        "Enumerating the website to see links to the HelpDesk and Mattermost",
        "Attempting to enumerate the version of osTicket",
        "Searchsploit json output shows the date",
        "No exploits found, lets open a new ticket and see it gives us a way to update the ticket via email",
        "Creating an account on Mattermost with the email of the helpdesk to get the activation link",
        "Viewing the internal chat and seeing a password, then SSHing to the server",
        "Using hashcat to create a wordlist with its internal rule system",
        "Going over how Hashcat Rule files work",
        "Root #1: Running sucrack to bruteforce the root users password",
        "Root #2: Cracking the Mattermost Password"
      ]
    },
    {
      "name": "Derailed",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Looking at the HTTP Headers, discovering Cross Origin and rails",
        "Testing the Clip Notes functionality for SSTI/XSS",
        "Using FFUF to fuzz all Clip Notes to see if there's an IDOR Vulnerability",
        "Looking at how the site is build, discovering Web Assembly",
        "Sending a long string for the username and discovering the data overflows and goes into the Date field",
        "Using Pattern Create to find where our payload hits the date field",
        "Testing for XSS",
        "Seeing Cross Origin blocked us, adding the headers to get it loading javascript from our server",
        "Using XMLHttpRequest in our XSS to control the victim's browser and see what is on /administration",
        "Looking at the Administration page, discovering there is a File Disclosure"
      ]
    },
    {
      "name": "Devel",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Going over NMAP",
        "Anonymous FTP + File Upload",
        "Exploit Suggestor",
        "Getting Root"
      ]
    },
    {
      "name": "Developer",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Examining the web page, noticing every URL with admin gets redirected to a django login",
        "Creating an account and looking at the page to discover CTF Challenges",
        "CHALLENGE 1: Phished List, a protected excel spreadsheet. Remove protection to see hidden cells",
        "Submitting a writeup, discovering an old version of Firefox talks to us",
        "Checking for Tab Nabbing vulnerability and explaining it",
        "Creating a phishing page by mirroring the page with wget and then using PHP to log submitted credentials",
        "Phishing worked, got the admin's password. Login to Django to see another website (Sentry)",
        "Creating an error message in Sentry to get an error message, which contains a secret key used to encrypt the cookie",
        "Grabbing a django deserialization payload then installing django on python2 to use the payload",
        "Changing the payload in the exploit to a reverse shell, avoiding any bad characters for URL and getting a reverse shell"
      ]
    },
    {
      "name": "DevOops",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of Recon",
        "Start of GoBuster",
        "Looking at /upload, testing with a normal XML File",
        "Valid XML File created, begin of looking for XML Entity Injection XXE",
        "XXE Returns a a local file off the server",
        "Grabbing the source code to the webserver to find newpost function.",
        "Discovery of vulnerability due to user data being passed to pickle",
        "Creating the script to exploit pickle",
        "Reverse shell returns!",
        "Poking around at Source Code",
        "Discover of an SSH Key within deployment stuff.",
        "Trying SSH Key for other users on the box to see if it is valid"
      ]
    },
    {
      "name": "Devvortex",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Discovering dev.devvortex.htb is a Joomla Page, showing JoomScan and enumerating version manually through manifests",
        "Looking for Joomla Exploits for version 4.2.6, discovering a way to view application config as an unauthenticated user",
        "Start of deep dive into the exploit, looking at commits on the day the advisory said this was patched",
        "Showing the fix just shows it is a mass assignment vulnerability, looking at how this works",
        "Showing fuzzing for arguments with ffuf would have caught this",
        "Logging into Joomla, then placing a shell in the Joomla Templates",
        "Logging into the database, cracking a hash to gain access to another user",
        "Taking a look at sudo discovering apport-cli, gtfobins comes up with nothing, looking at the version to discover an exploit within how it uses PAGER"
      ]
    },
    {
      "name": "Devzat",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Poking at the SSH Chat Application",
        "Running a VHOST Scan and discovering pets.devzat.htb",
        "Discovering pets.devzat.htb doesn't have a 404 and is a golang webserver",
        "Fuzzing the user input on pets",
        "Webapp ignores when a semicolon is at the end of user input, indication to command injection [MasterRecon]",
        "Using Gobuster to discover the .git directory and working around the issue of the box having no 404 errors. Use git-dumper to extract.",
        "Doing some light source code analysis on the Go Binary",
        "Showing it is also an LFI Vulnerability, just incase command injection was patched",
        "Reverse shell returned, examining the git log of the files, don't see anything interesting",
        "Discovering from localhost we can login to chat as anyone, but messages are hidden on Reverse Shells. Switch to SSH and read the messages."
      ]
    },
    {
      "name": "Doctor",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of Nmap",
        "Poking at the website and doing Gobuster/SQLMap In the BG",
        "Registering an account and enumerating the new features, looking for XSS",
        "Testing if the box will click links, discovering Curl reaches back to us",
        "Finding command injection in the URL, finding a way to execute commands with spaces",
        "Brace expansion isn't working, but IFS allows us bypass space being a bad character",
        "Trying to get a reverse shell but failing due to bad characters",
        "Using Curl to download a rev shell script and then execute it in order to avoid bad characters",
        "Transfering site.db to our box, so we can view the contents and attemp to crack the admins password",
        "Finding out we are part of the ADM Group and can read logs! Log contains a password",
        "Checking the Splunk Version and looking for exploits"
      ]
    },
    {
      "name": "Dog",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap, discovering an open .git directory",
        "Using git-dumper to download the source code and discovering MySQL credentials",
        "Trying to enumerate usernames but running into bruteforce protection in the login and reset password functionality",
        "Looking for other ways to enumerate users, finding BackDropScan which shows another endpoint which is unprotected",
        "Logging into backdrop, then installing a malicious module",
        "Getting a shell on the box and then password re-use lets us switch to a different user",
        "We can run Bee with Sudo, finding out it has an eval command that lets us run commands",
        "Showing another way to find valid users, searching the git files for emails and getting tiffany."
      ]
    },
    {
      "name": "Down",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Entering our IP Address in the \"Is it Down\" and see the server makes a curl back to us, trying command injection",
        "Could not do Command Injection, trying Argument Injection",
        "Bypassing the filter that requires the URL to start with http://  by using a space and then using file:// to get file disclosure",
        "Reading the source of index.php, discovering it has a hidden mode that lets us swap curl for netcat",
        "Getting a shell by using argument injection with netcat",
        "Discovering PSWM in a home directory, which is a password manager like application",
        "Building a script to crack the PSWM file",
        "PSWM is decrypted, getting the root credential"
      ]
    },
    {
      "name": "Download",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Playing with the download file functionality, discovering the UUID is the file on disk and not column in database by prepending a slash",
        "Finding a File Disclosure vulnerability, extracting application source code, getting source code of the app",
        "Start of signing our own cookies, examining the sig cookie to discover it is 40 bytes which is likely sha1",
        "Playing with Cyber Chef to discover how the cookie is signed",
        "Creating a python application to create and sign cookies so we can become other users",
        "Becoming other users and looking at all uploaded files",
        "Explaining the ORM Injection, looking at Prisma Documentation to discover how we can perform boolean injection",
        "Showing the proof of concept payload, and then making the script loop to extract the entire password field",
        "POC Script done, but it is slow. Adding concurrency/threading with asyncio/await to our script to speed it up",
        "Modifying the script to dump multiple users, and finding WESLEY's password"
      ]
    },
    {
      "name": "Drive",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "[MasterRecon] Examining CSRF Cookie to discover it is likely Django",
        "Using FFUF to bruteforce ID's of uploaded files, can discover valid ID's but not view the ID itself",
        "Accidentally deleting something important when FUZZING, always be careful of what you are doing with tools",
        "Discovering the /block endpoint allows us to view any file, discovering a file with credentials which lets us log into the server",
        "Setting up a SSH Tunnel to access port 3000, which is Gitea. Discovering an old commit that has the password to decrypt backups",
        "Logging into the box as Tom, discovering the DoodleGrive Binary, opening it up in Ghidra",
        "Looking at the Sanitize_String command, to see what characters we cannot use",
        "Exploiting DoodleGrive via SQL Injection with the EDIT command, this is easy to exploit because SetUID's preserve environment variables",
        "Got root, our path is messed up which makes the shell hard to use, however fixing the path is easy",
        "Exploiting DoodleGrive via LOAD_EXTENSION, by dropping a library and using char() to avoid the sanitize string function"
      ]
    },
    {
      "name": "Driver",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Start of nmap",
        "Quickly testing SMB, then using CME to get a hostname of the box",
        "Testing out the website, discovering admin:admin logs us in. Running gobuster with HTTP Auth",
        "The website allows us to write to a file share. Going over SCF Files and how we can use them to steal NTLMv2 Hashes by having an external icon",
        "Using hashcat to crack the NTLMv2 Hash",
        "Using CME with these credentials to discover we can WinRM to the box",
        "Downloading WinPEAS and using our Evil-WinRM shell to execute it",
        "Going over the WinPEAS Output and discovering a Ricoh printer driver",
        "Going over the Ricoh printer driver exploit",
        "Switching to Metasploit, showing an issue with the WinRM Module in MSF",
        "Using MSFVenom to create an executable then having WinRM send us the meterpreter shell"
      ]
    },
    {
      "name": "DropZone",
      "os": "Windows",
      "difficulty": "Hard",
      "techniques": [
        "Start of Recon",
        "TFTP Enumeration - Identifying configuration and OS information",
        "Finding a path to code execution",
        "Examining PSExec Metasploit Module",
        "Using irb within metasploit to print a powershell payload",
        "Examining PsExec()",
        "Examining native_upload",
        "Examining mof_upload",
        "Using irb within metasploit to print the MOF File",
        "Quick explanation of MOF Files",
        "Modifying the MOF to run NetCat",
        "Uploading nc to the target"
      ]
    },
    {
      "name": "Dynstr",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap discovering the distribution of Ubuntu based upon SSH Headers",
        "Looking at the WebPage and discovering credentials",
        "Checking No-IP's documentation for updating Dynamic DNS Names",
        "Using Curl to create a dynamic DNS Name",
        "Testing for Command Injection",
        "Enumerating the bad character and explaining why we could not use periods",
        "Converting the IP Address to a format that won't have periods (Hex)",
        "Reverse Shell returned, checking out the web source",
        "Discovering hosts from *.infra.dyna.htb can ssh into the box if there is a private key and finding the private key in the support directory",
        "Using SSH-Keygen to get the SSH Keys fingerprints to make sure private and public key match",
        "Attempting to create the DNS Record with the DNS Key that was in the web source"
      ]
    },
    {
      "name": "Dyplesher",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Start of the box, running nmap with all ports.",
        "Using a Google Image Search to map icons with applications",
        "Manually fuzzing test.dyplesher.htb to check if there's any easy vulns",
        "Running NMAP Scripts against the results of our full port scan with awk and ORS",
        "Discovering a .git repo exposed on the website, using git-dumper to download it",
        "Memcache credentials discovered, download and test auth",
        "Creating a simple web application that will let us fuzz the remote memcat service",
        "Logging into GOGS as Felamos to download another repo, using git to restore a git bundle file",
        "Logging into dyplesher.htb with creds in the Git Repo",
        "MINECRAFT PLUGIN: Setting up our environment (IntelliJ)",
        "MINECRAFT PLUGIN: Skeleton Code"
      ]
    },
    {
      "name": "EarlyAccess",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap, adding earlyaccess.htb to the hostfile",
        "Registering an account to see what features are enabled to regular users",
        "Discovering bad characters of username are only checked upon registration, not changing it from the profile page",
        "Testing the Contact Forms for XSS by sending a message to ourself",
        "Using document.location javascript to steal cookies",
        "Taking the administrators cookie and discovering some new hosts/functionality/key validation script",
        "Going over the key validaiton script",
        "Breaking the first part of the Key which is a simple Bit Shift and XOR to get KEY01",
        "Breaking the second part of the key which calculating every permutation of when two strings equal eachother",
        "Showing the lazy way to do the second part, since we never actually need to know every combination",
        "Breaking the third part of the key, which has a rotating magic. Discovering the keyspace for magic is only 60"
      ]
    },
    {
      "name": "Editor",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Noticing the docs link which directs us to xwiki which discloses its version, searching for vulnerabilities",
        "Looking into XWIKI CVE-2025-24893",
        "Got Code Execution, getting a reverse shell now",
        "Finding the xwiki config, getting a password, which lets us SSH as oliver but oddly cannot use SU (go into this at the end of the video)",
        "Finding a vulnerable SetUID File, ndsudo from netdata. Vulnerable to Path Injection, lets exploit it",
        "Just talking about SetUID vs Sudo",
        "Digging into why we could not run SU",
        "Why we couldn't run SU, the SystemD Unit file has NoNewPrivileges"
      ]
    },
    {
      "name": "Editorial",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering the webserver is likely running Flask",
        "Discovering a SSRF in the request to publish books, showing we could leak the servers IPv6 Address but its not too useful here",
        "Using FFUF to fuzz all open ports on localhost to discover port 5000 is open which is an API Server",
        "Looking at the messages endpoint, which discloses a password for dev which we can SSH With",
        "Discovering a git directory, searching git commits for the word prod and getting another password",
        "The Prod user can run a python script which is using the python git library, which has an RCE CVE. We can use the Shell Extension in the URL to execute code"
      ]
    },
    {
      "name": "Ellingson",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Begin of recon, examining website seeing the \"Hackers\" Theme",
        "Discovering a Flask/Werkzeug Debug page (Patreon Hack of 2015)",
        "Demoing how this is fixed now, with Werkzeug requiring a pin code",
        "Testing if we can connect back to our host with ping or curl (cannot)",
        "Dropping a SSH Key via python since we cannot reverse shell",
        "SSH into the box as the HAL User and clean up the authorized_key file",
        "Using xclip to copy and run LinEnum due to a firewall preventing us from curling it",
        "Discovering why the WERKZEUG PIN Code was disabled (Environment Variable)",
        "Checking out the Garbage SetUID Binary as HAL to discover he cannot run it",
        "Using Ghidra to verify we are not missing any functionality",
        "Using find to discover what files the adm group is an owner of",
        "Displaying exact modify times with ls using time-style argument, then checking logs to see what users changed their password after the shadow backup"
      ]
    },
    {
      "name": "Encoding",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Checking out the API Documentation",
        "Interacting with the API Server",
        "Showing the file_url, parameter and showing we can access local files",
        "Building a webserver in Flask to make some middleware to exploit this SSRF, allowing us to easily download files from the webserver",
        "Our middleware works! Can download files off the server.",
        "Downloading the apache2 configuration to find where all the webserver files are hosted",
        "Using gobuster against our middleware to discover any hidden webfiles, have to edit our middleware to return 404 if it didn't return a file",
        "Running gobuster against our code now that it gives 404... Its going slow, switching to a different wordlist and finding a .git repository",
        "Git-Dumper fails because our middleware isn't setting content-type correctly.  Have to fix that",
        "Opening the source code from the .git repo up in Visual Studio code and Snyk shows us there is an LFI"
      ]
    },
    {
      "name": "Enterprise",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of recon",
        "Finding the vulnerable Wordpress Plugin",
        "Exploiting lcars plugin",
        "Logging into WP and Getting Reverse Shell",
        "Wordpress RevShell Returned",
        "Using Meterpreter to pivot and provide access to MySQL",
        "MySQL Shell Returned",
        "Logging into Joomla and Getting Reverse Shell",
        "Joomla Reverse Shell returned",
        "Getting Reverse Shell on Host OS (port 443)",
        "Shell Returned begin of local privesc recon",
        "Beginning of Binary Exploitation"
      ]
    },
    {
      "name": "Environment",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering that Laravel is running based upon 404 page (or cookie)",
        "Running GoBuster, adding 403 to the ignore list of codes and discovering /upload",
        "Laravel running in DEBUG mode, so the error page gives verbose info. Searching for CVE's for Laravel 11.30.0",
        "CVE-2024-52301, changing the Laravel environment with argument pollution",
        "Discovering we can bypass auth by setting environment to preprod",
        "Exploiting another Laravel CVE-2025-27515 to bypass the extension blacklist",
        "Got a shell on the box, dumping database",
        "Discovering a GPG Encrypted file, using keys on the box to decrypt it",
        "Sudo lets us keep the environment BASH_ENV which lets us set the bash environment to a script and privesc",
        "Beyond root, showing disabling debug mode on application and nginx config"
      ]
    },
    {
      "name": "Era",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering the file subdomain",
        "Bruteforcing files to find login.php",
        "Bruteforcing ID's on the download functionality, discovering two other files",
        "Got creds from the database dump, logging into ftp and downloading Apache backup",
        "Looking at the source code, discovering some weird behavior around PHP Streams and the download functionality",
        "Logging in as admin with security questions",
        "Looking at PHP Wrappers, then using the SSH One to login and run a command to get a shell",
        "Looking at files owned by the group devs, discovering a monitor binary",
        "Making an ELF File and uploading it, to discover it needs to be signed",
        "Using docker to build the linux-elf-binary-signer program on github, then signing the binary"
      ]
    },
    {
      "name": "Escape",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Examining SSL Certificates and seeing \"sequel-DC-CA\", which hints towards there being a Certificate Authority",
        "Using CrackMapExec to enumerate file shares",
        "Accessing the Public Share, downloading a PDF File and finding credentials in it, using CME again and using CME to test smb, winrm, and mssql",
        "Using mssqlclient to login to access MSSQL",
        "Using XP_DIRTREE to request a file off an SMB Share in order to intercept the hash of the user running MSSQL, then cracking it",
        "Using Evil-WinRM to login to the box with SQL_SVC account, uploading Certify.exe and not finding a vulnerable certificate",
        "Looking at the error logs and discovering a user entered their password as a username so it got logged. Logging in as Ryan.Cooper",
        "Running Certify again as Ryan and finding a vulnerable UserAuthentication Certificate",
        "Using Certify Scenario #3 to create a UserAuthentication certificate with Administrator as the Alt Name which lets us authenticate as them",
        "Cannot use the certificate for WinRM because there isn't SSL (5986)"
      ]
    },
    {
      "name": "EscapeTwo",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Doing some low-priv AD recon with NetExec (SMB, MSSQL, User Dump, Shares, Bloodhound, etc)",
        "Looking at the Spider_Plus output and seeing two interesting excel files",
        "Cannot open the Excel, unzipping it to look at the files manually and discover the SA password to MSSQL",
        "Running MSSQL Commands with NetExec and the SA user to get a shell on the box",
        "Discovering the SQL Install directory with a configuration file that has a password, spraying all users with that password to see it works with Ryan",
        "Looking at what our owned users can do via bloodhound",
        "Showing SharpHound collects more data than the python ingestor",
        "Showing an attack path of Ryan Taking over CA_SVC which can perform ESC4",
        "Using OwnerEdit/DaclEdit to take over CA_SVC then Certipy to create a shadow credential and get the NTLM Hash",
        "Talking about the ESC4 Exploit"
      ]
    },
    {
      "name": "Ethereal",
      "os": "Windows",
      "difficulty": "Insane",
      "techniques": [
        "Begin of Recon, Downloading FTP and inspecting websites",
        "Recap of what we saw on the recon. Limited pages that provide paths for exploitation, Server Hostname, and FTP",
        "Sending MD5Hashes to VirusTotal to get file age",
        "Downloading PasswordBox sourcecode to examine pbox.dat and discover a password manager.",
        "Use Hydra to try to bruteforce ethereal.htb:8080, find blind command injection in page by running various ping commands but no way to view output.",
        "Using nslookup to exfil the results of commands executed.",
        "Creating Python Script to automate exploitaiton of this program.  Using Scapy, BeutifulSoup, and Requests.",
        "Script working! Now to make the output a bit more pretty using tokens to sepereate spaces",
        "Running commands to get interesting information about the page",
        "Enumerating the Firewall via netsh",
        "Using OpenSSL to get a reverse shell on windows",
        "Reverse shell returned."
      ]
    },
    {
      "name": "Eureka",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering the default 404 page of Springboot, then using GoBuster with a Springboot wordlist to show actuator endpoint",
        "Showing a good blog post about Actuator Misconfigurations",
        "Downloading the heapdump, while that downloads, showing Nuclei will show this with default options",
        "Using strings to look for sensitive things in the heapdump",
        "Showing VisualVM which lets us search heapdumps with OQL Queries which is like SQL",
        "Using JDumpSpider to analyze the heapdump, does a good job at showing only the security relevant things",
        "SSH into the box with the Oscar190 account, which we got from the heapdump.",
        "Finding log_analyse.sh bash script, we can't exploit this yet but sometimes it is useful to backtrace from vulnerable things to find the path",
        "User controlled input to the bash eq functionality which leads to code execution",
        "Running pspy to see if this program gets executed from a cron and getting the arguments sent"
      ]
    },
    {
      "name": "Europa",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Image in the intro is an XKCD comic if you didn't immediately recognize it as XKCD check out https://xkcd.com",
        "Recon with Sparta",
        "Enumerating SSL Certificate",
        "Manually View SSL Certificate",
        "VirtualHostRouting Explanation",
        "SQL Injection - Auth Bypass",
        "Dumping the Database with SQLMap",
        "Begin of Web Exploit (Regex //e)",
        "Getting a Shell",
        "Begin PrivEsc (CronJob)"
      ]
    },
    {
      "name": "EvilCUPS",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Examining the CUPS Management Interface on TCP Port 631",
        "EvilSocket's blog, explaining the four CVE's and how they are utilized in our attack chain",
        "Showing the GHSA Advisory that had the initial POC that I had trouble getting working",
        "Talking about the Cups-Browsed packet (UDP) we send, which causes CUPS to make an HTTP/IPP Request to our server to install the printer",
        "Talking about the attributes we send, and where the exploit begins. We will inject an extra attribute in the print-more-info attribute",
        "Running the exploit to send us a reverse shell, talking about the cups browsed packet while we wait",
        "Going back to the CUPS Management Page and we can see a new printer, printing a test page to get a shell on the box",
        "Showing there was a print job we didn't create, starting CUPS locally so we can see how CUPS Stores print jobs",
        "Seeing cups stores our jobs in /var/spool/cups/d(5 digit print job)-(3 digit page num).",
        "Going back to our shell, discovering it got killed, getting another shell with nohup so we fork out of the process"
      ]
    },
    {
      "name": "Explore",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of nmap",
        "Weird SSH Banner saying its Banana Studio, google tells us this is Android",
        "Doing a script scan against all open ports, and googling what each open port is",
        "Port 59777, brings us to ES File Explorer which has an exploit out",
        "Running the ES File Explorer exploit with getDeviceInfo to confirm it works",
        "Listing files, pictures, and eventually downloading a picture",
        "Opening the picture reveals some credentials, can ssh into the box with them",
        "Installing ADB, so we can do adb connect to port 5555",
        "Setting up an SSH Port forward so we can access port 5555",
        "Extra Content: Playing with the exploit script to understand what it does"
      ]
    },
    {
      "name": "Extension",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap, then discovering a laravel app",
        "Laravel app uses Ziggy which exposes a list of all the routes",
        "Finding the /management/dump endpoint but we keep getting page expired (missing some headers)",
        "Using ffuf to brute-force the management/dump endpoint",
        "Dumping a list of users and then cracking them",
        "Enumerating virtualhosts, then looking at the roundcube version",
        "Discovering the first 32 characters of the password reset token does not change",
        "Attempting to bruteforce the password reset token for Charlie's password but discovering there's rate limiting in play",
        "Spamming the password reset link to generate multiple tokens, which will allow us to guess a token",
        "Edit, explaining the multiple password reset vulnerability more in depth",
        "End of edit, resetting charlie's password"
      ]
    },
    {
      "name": "Faculty",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Testing login of the webapp, finding SQL Injection to bypass it",
        "Running gobuster with our cookie so it has access to any authenticated page",
        "Examining the course edit functionality and discovering how the page tells us if our update was a success",
        "Explaning the dangerous thing with update injections, we accidentally changed EVERY row.",
        "Extracting information from this Update Injection in MySQL by editing a second column",
        "Standard MySQL Injection to extract table information from Information_Schema, then dumping hashes",
        "Showing a second login form, which is also SQL Injectable",
        "Examining the Generate PDF Function",
        "Verifying we can put HTML in the PDF",
        "Going to GitHub Issues and finding issues with MPDF to find vulnerabilities in old versions"
      ]
    },
    {
      "name": "Falafel",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "*Note: RationalLove was patched after I did this box.  So mistakenly thought it was still vulnerable.  Enjoy the fails/confusion!",
        "Begin of Recon",
        "Bruteforcing valid users",
        "Manually finding SQL Injection",
        "Using --string with SQLMap to aid Boolean Detection",
        "PHP Type Confusion ( == vs === with 0e12345) [Type Juggling]",
        "Attempting Wget Exploit with FTP Redirection (failed)",
        "Exploiting wget's maximum file length",
        "Reverse Shell Returned",
        "Linux Priv Checking Enum",
        "Checking web crap for passwords",
        "Grabbing the screenshot of tty"
      ]
    },
    {
      "name": "Fatty",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Using wget to recursively download files off an annonymous FTP Server",
        "Attempting to execute the Java Thick Client, then switching to Java version 8 and trying again",
        "Seeing the Thick Client makes some DNS Requests, make the DNS Request resolve and attempt to intercept with Burp",
        "BurpSuite failed us, using SOCAT to forward the traffic and exploring the Thick Client features",
        "Using CFR to decompile a Java JAR File then VS Studio Code to analyze the source",
        "Downloading Eclipse and then configuring it to utilize Java 8 and creating a Hello World Java Application",
        "Importing a Java JAR File into our Java Project then calling Login",
        "Replicating the functionality to identify what Role we are, then other functions",
        "Calling the Invoker Class to execute methods on the server",
        "Attempting to call methods that the GUI prohibited us from",
        "Using ShowFiles to see we can list files in our parent directory, then using Open to download files"
      ]
    },
    {
      "name": "Feline",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap digging into Version numbers of applications",
        "Finding Tomcat is an old version",
        "Checking out the web page",
        "Playing with the file upload, uploading an EICAR to test virus scanning",
        "Finding if we put a directory or nothing for filename we get an error message",
        "Looking at Tomcat exploits to see that we may be able to perform a deserialization attack by uploading a serialized object",
        "Using ysoserial to generate a CommonsCollection payload",
        "Showing a trick to copy binary content into BurpSuite",
        "Testing RCE by making the application ping us",
        "Failing to get a reverse shell, going through a lot of issues, attempting to encode our command to avoid bad characters",
        "Attempting to use a different one-liner to get a shell"
      ]
    },
    {
      "name": "Fighter",
      "os": "Windows",
      "difficulty": "Insane",
      "techniques": [
        "Begin of Recon Nmap, Identify OS Version, Check out Page to find hostname is streetfighterclub.htb.",
        "Using GoBuster and WFUZZ to identify: members.streetfighterclub.htb and members.streetfighterclub.htb/old/login.asp",
        "Begin poking around the members.streetfighterclub.htb page - Find SQL Injection",
        "Boolean injection to force the query to return \"valid login\".  Play with logins to find it always returns to \"Service not available\"",
        "Testing Union Injections for easy exfil of data",
        "Examining Stacked Queries to make running our own SQL Statements easy.  Then bunch of injections to run Xp_CMDShell and get output.",
        "Some valuable recon/information in debugging our SQL queries. Noticing small things really helps.",
        "Start of making a program to give us a command shell.",
        "Explaining the program we just created.  Then fix a small bug.",
        "Begin of popping the box the intended way.  Finding powershell is blocked but specifying the 32-bit version is not",
        "Return of 32-bit PowerShell... Identifying we can append data to c:\\users\\decoder\\clean.bat -- That's odd lets try to place a shell in it to see if it is being ran.",
        "Found the issue! Powershell is encoding in UTF-16 which is confusing cmd prompt.  64-bit Shell as Decoder returned!"
      ]
    },
    {
      "name": "Fingerprint",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Start of nmap, checking websites seeing old copyrights",
        "Discovering the HTTP Redirect on /login is pretty big, so its likely an EAR Vulnerability",
        "Discovering a LFI that enables us to read source code, chaining it with the proc directory and using wfuzz to discover additional python files",
        "While our wfuzz runs testing against a login endpoint to discover an XSS in another webapp",
        "Going over the Python Source code",
        "Discovering Hibernate Query Injection (HQL) on the login page on port 8080",
        "Going over HQL (Hibernate) Injection Using boolean injection to login but need the browser fingerprint of the user",
        "Using our XSS to execute the fingerprint function and sending it to our server",
        "Logging into the application with our custom fingerprint and boolean injection, getting a JWT with a Serialized Base64 Encoded Java Object",
        "Examining the Backups Directory and finding Java Sourcecode to the app on port 8080",
        "Going over the javacode we have to discover we can probably craft a deserialization payload to gain code execution"
      ]
    },
    {
      "name": "Fluffy",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Running NXC with the credentials we are given and kerberoasting",
        "Running Rusthound, still not finding all that much",
        "Looking at file shares, discovering a PDF on a writable share that states the server is vulnerable to CVE-2025-24071",
        "Making a malicious zip file by putting the .libary-ms file inside of the zip that points to our box, using responder to steal and crack the hash",
        "Identifying P.AGILA can add themself to Service Account Managers and take over Service Accounts",
        "Using BloodyAD to add ourself to a group, then certipy to use shadow credentials to obtain NTLM Hash over an account we have GENERIC WRITE to",
        "Using Certipy to identify and exploit AD ESC 16"
      ]
    },
    {
      "name": "Flujab",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Begin of Recon",
        "Adding DNS Names to /etc/hosts",
        "Using Aquatone to take HTTP Screenshots of a bunch of pages",
        "Start of looking at FreeFlujab.htb",
        "Looking at HTTP Cookies we send",
        "Editing Cookies in Firefox",
        "Discovering SMTP_CONFIG, which lets us change where the mail server is",
        "Using FireFox to remove character restrictions on a page",
        "The WebPage kept resetting our cookie, using Burp to auto replace",
        "Standing up a SMTP Server in python to read mail",
        "Discovering SQL Injection",
        "SQL Injection confirmed, testing Union Injections"
      ]
    },
    {
      "name": "Flux Capacitor",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of recon",
        "Wiresharking NMAP to identify fingerprint",
        "Checking the WebPage",
        "Finding /sync and why web browser has a 403",
        "Using wfuzz to find what arguments /sync takes",
        "The actual wfuzz command",
        "Finding Bad Characters with wfuzz",
        "Getting command execution",
        "Getting a reverse shell",
        "Privesc to root abusing custom script",
        "#### Box Done",
        "Examining how NGINX/OpenResty was configured"
      ]
    },
    {
      "name": "Forest",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Running NMAP and queuing a second nmap to do all ports",
        "Using LDAPSEARCH to extract information out of Active Directory",
        "Dumping user information from AD via LDAP then creating a wordlist of users",
        "Creating a custom wordlist for password spraying with some bashfu and hashcat",
        "Using CrackMapExec to dump the password policy of Active Directory using a null authentication, then doing a Password Spray",
        "Enumerating information out of AD using rpcclient and null authentication",
        "Now that our PWSpray is running in the background, lets go through Impacket Scripts to see what works.",
        "Using GetNPUsers to perform an ASREP Roast (Kerberos PreAuth) with Null Authentication to extract SVC-ALFRESCO's hash.  Then Cracking it.",
        "Using Evil-WinRM to get a shell on the box with SVC-ALFRESCO's credentials",
        "Setting up a SMBShare, using New-PSDRive to mount the share, then running WinPEAS",
        "Going over WinPEAS Output"
      ]
    },
    {
      "name": "Forge",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Running nmap finding a filtered port with some open ones",
        "Running GoBuster to always have something running in the background",
        "Playing with the Upload Form",
        "Playing with the Upload from URL to see what library connects back to us (SSRF)",
        "The Upload From URL has a blacklisted address, playing with it to discover what is blacklisted",
        "Bypassing the URL Blacklist in the SSRF by changing the case of words",
        "Running a virtualhost bruteforce within gobuster to discover vhost",
        "Bypassing the URL Blacklist in the SSRF by creating a webserver that will send a redirect",
        "Using the SSRF to download admin.forge.htb and discovering ftp creds and another SSRF",
        "Using the SSRF to use FTP",
        "Encoding the IP Address as hex to bypass a blacklist"
      ]
    },
    {
      "name": "Forgot",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Talking about Varnish, then looking at the website",
        "Poking at the Forgot Password functionality and showing we can enumerate valid users",
        "Discovering a username in the HTML Source",
        "Start talking about Host Header Injection, showing the page will use the Host Header when building redirects",
        "Using host header injection in the password reset, in order to send the user a link that goes to our box",
        "Explaining host header injection password reset in depth",
        "Live Demo showing that Host Header Injection on Password Reset may not require user interaction, mail filters love clicking links.",
        "Sending an email to myself, then checked Burpsuite Collaborator and saw some bots clicked our link and sent us the token that was in the email!",
        "Showing what Robert can do in the web application and discovering some odd behavior on the /tickets/ page.  Anything after the slash will return tickets and not 404!",
        "Identifying when Varnish decides to cache things by looking at the age header, and discovering whenever /static/ is in the URL it becomes cached and that the page doesn't check authorization before di"
      ]
    },
    {
      "name": "Format",
      "os": "",
      "difficulty": "",
      "techniques": [
        "For some reason, the last video got stuck encoding on YT's side and was 360p. Reuploaded and it worked the second time.",
        "Introduction",
        "Start of nmap",
        "Downloading source code from gitea",
        "Examining the website via browser to see what it does",
        "Making sense of how the sitebuilder works",
        "Examining the source code, discovering a file disclosure",
        "Creating a python script to automate the File Disclosure",
        "Script is done, downloading nginx configs. Then trying to find any directory we can write a PHP Script to",
        "Looking at how the site adds a pro license to users",
        "Explaining how we can do a protocol smuggling attack and access the REDIS socket to manipulate our user",
        "Showing that the plus is not being URL Decoded in the path of a URL but %20 is"
      ]
    },
    {
      "name": "FormulaX",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Examining the Change Password functionality",
        "Discovering XSS In the Contact Form",
        "Building an XSS Cradle that manipulates the DOM to load an external JS file",
        "Creating an XSS that will send interact with the webchat and exfil messages back to us",
        "Discovering a new subdomain from the Online Chat",
        "Showing why we could not use Script SRC with our XSS Attack and why we used the DOM Technique",
        "Looking at the Git Auto Report Generating and discovering it uses simple-git v3.14 which has an RCE Vulnerability",
        "Shell on the box, dumping the mongo database",
        "Shell as Frank_Dorky",
        "Looking at the services running on the box to enumerate what each port is"
      ]
    },
    {
      "name": "Fortune",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Begin of recon",
        "Exploring the web page on port 80",
        "Using wfuzz to do a special character fuzz to identify odd behavior and discover command injection",
        "Creating a hotkey in Burpsuite to send requests in repeater pane",
        "Start of creating a python program to automate this",
        "Script finished",
        "Exploring /var/appsrv",
        "Exploring authpf",
        "Hunting for the signing key for the CA to view HTTPS",
        "Copying the certificates to our box",
        "Creating and signing a Client Certificate",
        "Importing the certificate into FireFox"
      ]
    },
    {
      "name": "ForwardSlash",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Begin of Nmap",
        "Running Gobuster to Bruteforce the pages and subdomains to find backup.forwardslash.htb",
        "Registering an account and examining the functions to signed in users",
        "Playing with the ProfilePicture.php to discover we can do file inclusion",
        "Testing for RFI",
        "Using the PHP Filter Wrapper to convert php files to base64 and extract source code",
        "Start of creating a script to automate this",
        "Terminal portion of the script completed, now to add HTTP Requests",
        "Script cannot access the page due to requiring a login session, hard code the login cookie",
        "Script now is able to extract files off the server, now to add a save_file function",
        "Using the script we created as a library and building a brute forcer!"
      ]
    },
    {
      "name": "Freelancer",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering the website is Django, Wappalyzer tells us but also talking about how we could manually identify with the help",
        "Creating an account, discovering we need to activate it, using Forgot Password to activate it",
        "There is a QR Code that lets users login by scanning it, looking at the URL it appears there could be an IDOR",
        "Discovering ID 2 is an admin, crafting a QR Code with the admin ID in it and gaining access to the Django Admin",
        "Enumerating the MSSQL Database, discovering we can impersonate SA and then enable XP_CMDSHELL",
        "Trying to get a Reverse Shell, AV is blocking it, do some light obfuscation to bypass it",
        "Shell returned as the webapp user, can't get WinPEAS Running due to AV",
        "Discovering a password left behind by the SQL Express Install, password spray to get access to mikasaAckerman",
        "Showing the NxcDb, which logs all the successful logins with nxc",
        "Discovering a Memory Dump, downloading it to our box then using MemProcFs"
      ]
    },
    {
      "name": "FriendZone",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of Recon",
        "Running SMBMap to identify and crawl file shares",
        "Downloading creds.txt from an smb share and checking FTP/SMB",
        "Checking the webpage and grabbing potential DNS Names for the box",
        "Using dig to perform a DNS Zone Transfer to obtain additional host names",
        "Adding all hostnames to /etc/hosts",
        "Running Aquatone to take screenshots of all the pages for quick examination",
        "Testing Uploads.Friendzone.red",
        "Testing admin.friendzone.red",
        "Testing administrator1.friendzone.red, logging in with creds found from SMB",
        "Found an LFI in the Dashboard.PHP script (PageName Variable)",
        "Using PHP Wrappers with the LFI To obtain PHP Script Source"
      ]
    },
    {
      "name": "Frolic",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Begin of Recon, until around 13 minutes gathering information to avoid rabbit holes",
        "Using nc/ncat to verify a port is open (-zv)",
        "Doing gobuster across man of the sub directories",
        "Examining /admin/ - Examine the HTML Source because login is not sending any data",
        "Discover some weird text encoding (Ook), how I went about decoding it",
        "Decoded to base64 with some spaces, clean up the base64 and are left with a zip file",
        "After cracking the zip, there is another text encoding challenge (BrainF*)",
        "With potential information, return to our long running recon for more information",
        "Discovering /playsms",
        "Reading ExploitDB Articles and then attempting to manuall exploit PlaySMS via uploading a CSV",
        "Getting a reverse shell",
        "Running LinEnum.sh"
      ]
    },
    {
      "name": "Fulcrum",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Begin of Recon",
        "XXE Detection on Fulcrum API",
        "XXE Get Files",
        "XXE File Retrieval Working",
        "Lets Code a Python WebServer to Aid in XXE Exploitation",
        "Combining XXE + SSRF (Server Side Request Forgery) to gain Code Execution",
        "Shell Returned + Go Over LinEnum",
        "Finding WebUser's Password and using WinRM to pivot",
        "Getting Shell via WinRM, finding LDAP Credentials",
        "Using PowerView to Enumerate AD Users",
        "Start of getting a Shell on FILE (TroubleShooting FW)",
        "Getting shell over TCP/53 on FILE"
      ]
    },
    {
      "name": "Fuse",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Begin of nmap, see a Active Directory server with HTTP",
        "Gathering usernames from the website",
        "Using KerBrute to enumerate which users are valid",
        "Using Cewl to generate a password list for brute forcing",
        "Using Hashcat to generate a password list for brute forcing",
        "Trying to use RPCClient to change the password.  Cannot",
        "Using SMBPasswd to change the password",
        "Logging in via RPCClient and enumerating Active Directorry with EnumDomUsers and EnumPrinters",
        "Password for SVC-PRINT found via Printer description (EnumPrinters) in Active Directory, Logging in with WinRM",
        "Discovering SeLoadDriverPrivilege",
        "Switching to Windows Downloading everything needed for loading the Capcom Driver and Exploiting it"
      ]
    },
    {
      "name": "Ghost",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Taking a look at all the websites",
        "Showing why you should be careful when enumerating VHOSTS, also using gobuster in DNS mode since there are multiple web services and a DNS Server",
        "Discovering LDAP Injection in intranet page",
        "Showing how our LDAP Injection is boolean injection which lets us enumerate data in LDAP",
        "Creating a python program to perform the boolean injection",
        "Got the password for gitea_temp_principal",
        "Looking at the Intranet Backend code that was in Gitea which is written in Rust using the Rocket Web Library, finding a RCE but it protected by auth",
        "Looking at the Blog project in Gitea, that shows there is a modification to the Ghost CMS Application which has a File Disclosure vulnerability",
        "Exploiting the File Disclosure in the blog, downloading the SQL Lite Database, Grabbing the API Key from the environment and then getting a shell through the Rust API",
        "Shell returned on intranet container, discovering a SSH Control Master socket, which lets us ssh into the dev workstation without a password"
      ]
    },
    {
      "name": "Ghoul",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Begin of Recon, notice multiple SSH Host Keys",
        "Discovering the HTTPD Website has a PHP Script, Run SQLMap and update gobuster to find PHP",
        "Moving onto enumerating TOMCAT, default password (admin:admin) logs in and attempting to discover framework via google images",
        "Discovering that this TOMCAT page allows the ability to upload images and zips",
        "Explaining the ZipSlip Vulnerability",
        "Walking through how ZipSlip Works",
        "Start of using EvilArc with a PHP-Reverse-Shell to perform ZipSlip",
        "Reverse Shell Returned",
        "Looking at Secret.php to get potential usernames and passwords",
        "Discovering tomcat listens on port 8080 then use that to drop SSH Key to get root (Unintended Path)",
        "Enumerating HTTPD PHP Scripts and TOMCAT Config to find some usernames and passwords",
        "Using find to list files modified between two dates"
      ]
    },
    {
      "name": "Giddy",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Begin of intro",
        "Examining port 80 and 443",
        "Using gobuster to discover directories",
        "/remote discovered, nothing to do here",
        "/mvc discovered",
        "SQL Injection everywhere",
        "Attempt to perform union injection on search",
        "Having trouble, send to SQLMap look at other places in the applicaiton",
        "SQLMap having trouble with search SQL, change to ITEM",
        "Attempting XP_CMDSHELL (Fails)",
        "Using XP_DIRTREE to read files off SMBShare",
        "Use Responder to steal the authentication attempt of XP_DIRTREE"
      ]
    },
    {
      "name": "GiveBack",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Adding the API Key to our WPScan",
        "Discovering a POC for the GiveWP plugin and getting a shell",
        "Looking at the WP Database, not getting much information",
        "Discovering an HTTP endpoint in the environment variable, setting up chisel to look at it",
        "Looking at the custom web page, it is vulnerable to a PGP CGI Vulnerability",
        "Shell on the second pod",
        "Discovering a Kubernetes (k8s) token, copying it back to our box and setting up kubectl to examine Kubernetes and dumping secrets",
        "Showing we didn't need KubeCTL we could have used curl, showing hacktricks age that has some nice tips on setting this up to easily query the k8s api",
        "With a password from k8s, we can login to the box and execute a runc wrapper with sudo. It is running version 1.1.11 which is vulnerable to an sandbox escape.",
        "Showing an alternative way to exploit this binary through exploiting the wrapper with a simple path traversal in mounts"
      ]
    },
    {
      "name": "Gofer",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Running gobuster to discover the proxy.gofer.htb subdomain",
        "Enumerating SMB to find a note which gives an email address to send a malicious document to and hints at HTTP Methods being filtered",
        "Discovering the proxy.gofer.htb domain responds differently to POST vs GET requests, then gobustering setting our method to POST",
        "Finding a SSRF in the proxy, then playing with protocols to discover it accepts GOPHER requests",
        "Showing we can get around the localhost/127.0.0.1 blacklist by encoding the IP Address in HEX, then showing why gopher requests are cool",
        "Sending a SMTP Request via gopher to send an email with a link to a malicious file",
        "Making a ODT Document with a macro that executes on-open and sends a shell",
        "shell as jhudson",
        "Going over LinPEAS, discovering TCPDump has capabilities to allow any user to capture packets",
        "Opening the capture in Wireshark and showing the TBuckley sent his password to the proxy, then SSH as him"
      ]
    },
    {
      "name": "Granny and Grandpa",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Heads up.  The pivot idea, was a pretty big fail.  Should of prep'd more but was short on time.  Enjoy watching me struggle, if you wanted to see the pivot stuff working I uploaded an updated video he",
        "Nmap Results (Discovery of WebDav)",
        "HTTP PUT Upload Files",
        "MSFVenom Generate aspx payload",
        "User Shell Returned",
        "Get Admin Shell (ms14-070)",
        "Beginning of Pivot Fail.  Socks Proxy",
        "Shell on Grandpa (CVE-2017-7269)",
        "Using portfwd to access ports not exposed to routable interfaces",
        "Cracking LM Hash Explanation",
        "Cracking LM Hashes via Hashcat"
      ]
    },
    {
      "name": "Greenhorn",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Discovering Pluck CMS, getting the version then looking for exploits",
        "Finding Pluck's password in Gitea (iloveyou1)",
        "Logging into pluck and uploading a php shell as a module",
        "Shell returned on the box",
        "Trying iloveyou1 as the password for junior and discovering a PDF",
        "Talking about why pixelation is a bad way to censor/redact things and finding Depix on GitHub",
        "Running Depix",
        "Trying the password as the root and getting in"
      ]
    },
    {
      "name": "Guardian",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering the portal.guardian.htb sub domain, there is a PDF here that shows the default password. Failing to enumerate valid accounts.",
        "Using FFUF to Bruteforce all accounts with the default password of GU1234",
        "Logging into the application, doing some quick notes of what functionality is exposed",
        "Identifying the Chat Functionality, attempting to see if there are broken access controls letting us read other users messages with ffuf",
        "Looking at the chats to admin, discovering a Gitea Password then finding the Gitea sub domain",
        "Doing some light enumeration against Gitea showing the Public API will let us enumerate if a user exists",
        "Logging in as Jamil and then downloading the portal source code and running it through Snyk",
        "Looking into the PHP Spreadsheet XSS Vulnerability and creating a python script to weaponize a document",
        "Stole the teachers cookie, switching our cookie and finding an CSRF Vulnerability",
        "Creating a quick CSRF Payload to add users"
      ]
    },
    {
      "name": "HackBack",
      "os": "Windows",
      "difficulty": "Insane",
      "techniques": [
        "Begin of Recon, discovery of an HTTP API that has a few commands",
        "Using JQ to parse json output, use NetStat/Proc to find GoPhish",
        "Logging into GoPhish with default creds admin:gophish, finding DNS Names",
        "Discovery of Obfuscated JavaScript Deobfuscating it to find a hidden section",
        "Using wfuzz to bruteforce the password for webadmin.php",
        "Finding Code Execution in WebAdmin.php",
        "Creating a Python Script to give a pseudo shell to cat, ls, and upload",
        "Script finished, uploading reGeorg to create a proxy onto the box to bypass FW",
        "Using WinRM to access low privilege shell as Simple User",
        "Exploring /Util/Scripts to find a way to privesc to Hacker",
        "Exploring GetSystem functionality of meterpreter"
      ]
    },
    {
      "name": "Hacknet",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Looking at Wappalyzer's technologies folder to see how it is detecting Django (csrfmiddlewaretoken)",
        "Showing Nuclei doesn't crawl any pages when it tried to detect tech",
        "Signing up for the site, playing with SSRF",
        "SSTI found, but it is Django Template Engine, looking at PayloadAllTheThings for payloads",
        "Creating a python script that will let us fuzz for variables in the Django templates context to see what we can dump",
        "Finding there is a users variable, which does include their password",
        "Modifying our script to like every single comment and then dump users to try and get as much user information as possible",
        "Creating a list of username:password and also emailUsername:password then running hydra to get SSH Access",
        "Looking at the Django Database, not finding anything too interesting",
        "Looking at Djangos File Based Cache, identifying we can take over the cache from SSH and get RCE"
      ]
    },
    {
      "name": "Haircut",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Exploiting exposed.php",
        "Getting Shell",
        "Screen Privesc"
      ]
    },
    {
      "name": "Hancliffe",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Identifying it is a windows box via ping and looking at its TTL, and running Gobuster with a lowercase wordlist since windows is not case sensitive.",
        "Looking at HashPass to see it just generates static passwords based upon Name/Website/Master Password",
        "Identifying a JSESSIONID cookie given when accessing /maintenance/ which enables a weird path traversal vuln [MasterRecon]",
        "Identifying the Nuxeo application and searching for the web vulnerability",
        "Testing for SSTI in an error message, normal SSTI doesn't work since it is java. Going to payloadallthethings to get a valid payload",
        "Testing an java EL SSTI Payload to get code execution. Don't get output but can validate we run code via ping",
        "Getting a reverse shell",
        "Looking at listening ports, running a powershell snippet to get process name and the port they listen on",
        "Looking for an exploit with Unified Remote.  Using Chisel to forward the port it listens on to us.",
        "Going over the Unified Remote Exploit script, changing where it writes files to and using msfvenom to generate a malicious exe for us"
      ]
    },
    {
      "name": "Hathor",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Navigating to the page",
        "Discovering the forgot password feature enables people to enumerate valid users",
        "Finding the default credentials for mojo portal and then logging in as admin",
        "Uploading an ASPX Webshell but finding out the aspx extension is blacklisted",
        "Looking at the GitHub issues for MojoPortal",
        "Copying a file to bypass the bad extension filter of uploaded material and getting our webshell",
        "Showing the importance of redirecting STDERR to STDOUT on web shells to discover why some commands fail",
        "Failing to run a Powershell Reverse Shell bypassing AV, only to find out it is in ConstrainedLanguage Mode",
        "Attempting to upload netcat to find out its blocked via group policy",
        "Enumerating Applocker with Powershell Get-AppLockerPolicy -Effective -xml"
      ]
    },
    {
      "name": "Hawk",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin nmap, discover FTP, Drupal, H2, and its Ubuntu Beaver",
        "Checking FTP Server for hidden files",
        "Examining encrypted file, discovering encrypted with OpenSSL and likely a block cipher",
        "Creating a bunch of files varying in length to narrow likely ciphers down.",
        "Encrypting all of the above files and checking their file sizes",
        "Decrypting file, obtaining a password",
        "Begin looking at Drupal, running Droopescan",
        "Manually examining Drupal, finding a way to enumerate usernames",
        "Placing invalid emails in create account, is a semi-silent way to enumerate usernames",
        "Logging into Drupal with Admin.",
        "Gaining code execution by enabling PHP Plugin, then previewing a page with php code",
        "Reverse Shell Returned"
      ]
    },
    {
      "name": "Haystack",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Begin of Recon find Elastic Search on 9200",
        "Checking the exif data in the image, nothing interesting, but showing FF changes some metadata when downloading (foresnic tip)",
        "Navigating to port 9200 and seeing the Elastic Search JSON Response",
        "Searching Elastic Search Documentation to see how to make queries",
        "Using /_cat/indices to see the \"tables\" withing ES",
        "Using /quotes/_search to dump the Quotes indicy, then using jq to extract desired data",
        "Lets switch over to Python to extract this data so we can translate this into English",
        "Installing googletrans, so our script can translate this.  Using python3 cli to test this out",
        "Adding googletrans to our script",
        "Running our script to translate everything and then using grep to \"find the needle\"",
        "SSH'ing to the box with the security user",
        "Running LinEnum, noticing kibana listening on 5601"
      ]
    },
    {
      "name": "Haze",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering splunk is version 9.2.1 from port 8089 and searching CVE Databases to find CVE-2024-36991",
        "Looking at how the File Disclosure works in CVE-2024-36991",
        "Extracting Splunk Secrets to get a username and password",
        "The user is denied the ability to list users in Active Directory, using RID Brute to get a user list",
        "Alternative way to bypass user list ACL by using AddComputer to add a computer which will let us query a list of users and run RustHound with Kerberos",
        "Examining what our users can do in Bloodhound",
        "Performing a password spray",
        "Listing GMSA Accounts with Get-ADServiceAccount, then using PowerSploit's Find-InterestingDomainACL",
        "Showing BloodyAD's Get Writable option then performing Write Owner, Add GenericAll, Adding ourself to group and using Certipy to get Shadow Credentials",
        "Going over the Splunk Backup, which contains the Admin Password for Splunk, using a grep regular expression to find password hashes"
      ]
    },
    {
      "name": "Headless",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Examining the cookie, measuring entropy with ent",
        "Testing the Contact Support form, putting HTML in the message triggers Hacking Attempt Detected",
        "Examining the /dashboard, playing with the cookie to see if we can view it",
        "Testing the Hacking Attempt Detected message for XSS",
        "Creating an XSS Payload to steal the cookie via fetch",
        "Replaying the cookie gets us into the Dashboard, finding command injection in the Generate Report",
        "Reverse shell returned",
        "Discovering DVIR can run Syscheck which is a bash script with a bash injection vulnerability and getting root",
        "Beyond root! Talking about how you can exfil HTTPONLY cookies if you find a page that replays the headers",
        "Start of creating a Javascript Payload to fetch a page and send it back to us"
      ]
    },
    {
      "name": "Heal",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering the version of LimeSurvey running by comparing the git with what is running",
        "Finding a File Disclosure in the export functionality of the RAILS App",
        "Using the File Disclosure to find the root by searching for Gemfile, then exporting the SQLite database",
        "Installing a malicious plugin for LimeSurvey to get shell on the box",
        "Getting the database password, then spraying it to get SSH Access to the box",
        "Discovering Consul is running on the box, finding an exploit and rooting the box"
      ]
    },
    {
      "name": "Health",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Taking a look at the website",
        "Testing the webhook to see the app will send us information about a web page",
        "Trying to access port 3000, getting blocked by a filter trying to include 127.0.0.1 and 0x7f000001",
        "Playing with the webhook to see if it will send us the entire page",
        "Having our webserver redirect to localhost, to see if this bypasses the filter and getting the web page on port 3000",
        "The application on port 3000 is gogs 0.5.5 which is from 2014!",
        "Setting up a local instance of GOGS so we can build a payload to exploit this",
        "Playing with a union injection, then looking at the database to see number of columns in the user table",
        "Have a basic Union Injection payload, grabbing multiple fields from the SQLite Database",
        "Checking how the password is encoded by examining gogs source"
      ]
    },
    {
      "name": "Heist",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Begin of recon",
        "Logging into the webpage as guest and viewing attachments",
        "Examining the cisco type 7 passwords, using  ciscot7",
        "Decrypting the MD5Crypt password using Hashcat",
        "Using CrackMapExec to perform a SMB password spray with users/credentials we have",
        "Using Metasploit to do the same thing (smb_login), to show it keeps tracks of creds. Then doing a WinRM Login",
        "WinRM Login was unsuccessful.  Lets see if we can enumerate users with Impacket's lookupsid",
        "Using RPCClient to replicate how LookupSID did the RID/SID Bruteforce, so we can understand it",
        "Doing the Winrm_Login again with new usernames and see Chase can login",
        "Using Evil WinRM to login to the box",
        "Low Priv shell returned",
        "Examining wwwroot, and sourcecode to see if we can get a shell as the IIS User (cannot)"
      ]
    },
    {
      "name": "Help",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Begin of recon",
        "Running gobuster to find /support",
        "Searching for a way to find version of HelpdeskZ",
        "Reading over the File Upload exploit script to see it requires server time",
        "Uploading a PHP Reverse Shell Script",
        "Going back to GitHub to find where uploads are saved",
        "Begin of modifying the script to pull the server time out of HTTP Headers",
        "Figuring out the python to pull the \"Date\" HTTP Header",
        "Getting the Time Format right with STRFTIME.COM",
        "Testing out the exploit and getting a shell",
        "Discovery of an old kernel, looking for an exploit",
        "Copying the exploit, compiling, and privesc!"
      ]
    },
    {
      "name": "Helpline",
      "os": "Windows",
      "difficulty": "Hard",
      "techniques": [
        "Begin of Recon",
        "Checking the ManageEngine Page",
        "Running Searchsploit to see potential exploits",
        "Enumerating valid usernames via AjaxDomainServlet",
        "Logging in with guest:guest",
        "Running the privilege escalation script to get Administrator access",
        "Searching for information on this exploit",
        "Blog post missing... Searching Archive.org and Google Cache for a mirror",
        "Making curl go through burp to step through the exploit in BurpSuite",
        "Copying the admin cookies into FireFox",
        "Going to Admin then Custom Triggers to execute code on the server",
        "Getting a reverse shell via Nishang"
      ]
    },
    {
      "name": "Holiday",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Articles Mentioned:",
        "https://ictf.cs.ucsb.edu/pages/the-2016-2017-ictf-ddos.html",
        "https://thehackerblog.com/poisoning-the-well-compromising-godaddy-customer-support-with-blind-xss/index.html",
        "NMAP Scan and Review",
        "GoBuster and identify User Agent based Routing",
        "SQLMap the Login",
        "Login to the page",
        "Begin of XSS",
        "Bypass first XSS Filter",
        "Encoded JS Payload - Getting XSS to call back to us",
        "Using Python to encode JS which will call back to us.",
        "Executing the paylaod"
      ]
    },
    {
      "name": "Horizontall",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of nmap, examining the page discovering its all static with no user input",
        "Examining the source code of the website",
        "Running the javascript through a beutifier so we can easily read this, and finding another web endpoint",
        "Going to api-prod.horizontall.htb, running gobuster and examining the endpoints",
        "Navigating to /admin brings us to a STRAPI login, searching for exploits and finding an RCE",
        "Lightly reading the exploit script, we will go more in depth at the end of this video",
        "Getting a reverse shell",
        "Reverse shell returned, looking for how the webapp talks to the database",
        "Explaining why this nginx server uses proxy_pass and has a node app listening on port 1337",
        "Dropping an SSH Key and using SSH to access this box, no privilege escalation yet just wanted a better shell",
        "Having a lot of trouble with getting data out of the MySQL Database, not exactly sure what went wrong here."
      ]
    },
    {
      "name": "Hospital",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Analyzing the TTL to see that the Linux Host is likely a Virtual Machine. Also Docker is not at play since it decremented",
        "Attacking the PHP Image Upload Form, discovering we can upload phar files",
        "Uploading a php shell, discovering there are disabled functions blocking system",
        "Using dfunc bypass to identify proc_open is not disabled and then getting code execution",
        "Reverse shell returned on the linux host",
        "Uname shows a really old kernel, then doing CVE-2024-1086 which is a NetFilter exploit between kernels 5.14 to 6.6, getting root and then cracking the hash to get drwilliams password",
        "Talking about Man Pages and how they are organized to identify $y$ is yescrypt",
        "Logging into RoundCube, discovering an email that indicates that drwilliams runs GhostScript with EPS Files, looking for exploit",
        "Building a malicious EPS File with a powershell reverse shell",
        "PRIVESC 1: Uploading a shell in XAMPP and getting system"
      ]
    },
    {
      "name": "iClean",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Taking a look at the website",
        "Testing the Get a Quote feature for XSS",
        "Weaponizing the img src xss test by adding fetch to attempt to exfil the cookies",
        "Looking at the dashboard and seeing what features are available",
        "Discovering SSTI in the QR Code Feature, can do basic SSTI but any complex fails without any evasion",
        "Explaining the SSTI Evasion with Jinja2/Python",
        "Shell returned on the machine, discovering Consuela's password in MYSQL",
        "Consuela can run qpdf as rood, looking at the man page and discovering it can attach files"
      ]
    },
    {
      "name": "Imagery",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Viewing the Flask Cookie with Flask-Unsign",
        "Discovering the Report Bug endpoint which is vulnerable to XSS and HTTP Only is false allowing us to steal cookies",
        "Another way to discover XSS, look at JavaScript in PageSource which leaks a lot of information",
        "Stealing the session cookie with img src xss payload",
        "Finding a File Disclosure then leaking the application source code",
        "Using Curl to download all the source code, making it easier to do source code analysis",
        "Using OpenGrep to locally run a basic static code analysis on the app",
        "Abusing the Command Injection to get a shell",
        "Discovering an AES Encrypted zip, copying it to our box then cracking with aescrypt2hashcat",
        "Using pyAesCrypt to decrypt the file"
      ]
    },
    {
      "name": "Inception",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of Recon + Finding dompdf",
        "PHP Wrappers + Failed testing for RCE",
        "Writing Python Program to automate file disclosure bug",
        "Finding WebDav Configuration + Uploading Files for RCE",
        "Modifying Sokar's Forward Shell (PTY over HTTP)",
        "Forward shell returned",
        "Using Squid to pivot to ports listening locally + NMAP via ProxyChains",
        "Getting nmap on Inception to speed up scanning private network",
        "Nmap results returned for 192.168.0.1, FTP Anonymous Login",
        "Finding TFTP as a Running Service",
        "Using TFTP to grab crontab & creating a pre-invoke apt script"
      ]
    },
    {
      "name": "Infiltrator",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Using grep against a HTML Page to extract usernames, then username anarchy to build a userlist and kerbrute to find valid users",
        "Kerbrute automatically will ASREP Roast but outputs in the stronger hash that hashcat doesn't crack. Using downgrade to get the weaker hash",
        "Using NXC with our creds to dump a list of users and see a password in the description",
        "Using Rusthound stead of the python version of Bloodhound because it gets certificate information too",
        "Showing a couple paths in Bloodhound",
        "Explaining and performing the attack (dacledit, shadow credential, force password change, bloodyad)",
        "Discovering Output Messenger running, using chisel to forward ports",
        "Having trouble with the Linux client of Output Messenger, cannot download a file",
        "Switching to Windows, using a regular portforward on chisel so our windows box can hit infiltrator",
        "Using ilSpy n the dotnet binary and decrypting a static string which is another password"
      ]
    },
    {
      "name": "Inject",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Trying to identify the technology running the webapp, 404 page reveals it is likely tomcat",
        "Running Gobuster, then checking out the page",
        "Uploading an image and discovering an file disclosure vulnerability",
        "Talking about how File Disclosures in Java can reveal directory listings, and grabbing pom.xml",
        "Using Snyk to identify vulnerabilities, but first we have to install Maven",
        "Exploiting CVE-2022-22963 Manually",
        "Playing with the exploit getting a reverse shell by dropping a file on the box (easy), then doing it without touching disk",
        "Shell as Frank, finding a password in the .m2/settings.xml file",
        "Shell as Phil",
        "Using find to show files owned by a group and finding a /opt/automation/tasks directory with ansible stuff"
      ]
    },
    {
      "name": "Instant",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Taking  look at the web application and fingerprinting the framework",
        "Using Jadx to decompile the APK File, then using grep to look for domains and discovering swagger",
        "Looking at the source code of the APK File and finding a hard-coded secret that allows us to make API Requests",
        "Finding a File Disclosure vulnerability in the Read Log functionality, grabbing a ssh key and logging in",
        "Looking at how apache is configured, which will show us where the webapp is. Then dumping the database",
        "Using Hashcat to crack Werkzeug hashes",
        "Taking a look at Solar-Putty in /opt/backups and cracking its config file"
      ]
    },
    {
      "name": "Intelligence",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap, discover Active Directory and a web server",
        "Doing some common checks against a Domain Controller",
        "Discovering PDF's with filenames based upon the date",
        "Building a customized wordlist based upon the date with the date command",
        "Downloading the PDF's with wget and then examining metadata",
        "Using Kerbrute to validate the usernames in the metadata are correct",
        "Using pdftotext to convert all the PDF's into text files, so we can grep through text",
        "Finding the password NewIntelligenceCorpUser987, then using KerBrute to perfrom a passwordspray",
        "Running CrackMapExec Spider_Plus while we do some other CME things",
        "Running Python Bloodhound with the credentials we got from the password spray",
        "Using JQ to parse the data from CME's spider_plus module to discover a powershell script"
      ]
    },
    {
      "name": "Intense",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Begin of nmap",
        "Examining the Message, pointing out the endpoint does not need authentication",
        "Using FFUF to fuzz the API End Point and show importence of Content-Type",
        "Starting SQLMAP then manually fuzzing this application",
        "SQLite Boolean Injection, with CASE IF/THEN/ERROR",
        "SQLite Boolean Injection, Enumerating Usernames",
        "SQLite Boolean Injection, Start of Dumping Password",
        "SQLite Boolean Injeciton, Optimization chat about UNICODE and SUBSTR",
        "Start of coding out python script to dump the hash",
        "This hash looks weird... Tons of troubleshooting",
        "Explaining the issue, we are hitting the 140 character limit... Switching script up to do SUBSTR"
      ]
    },
    {
      "name": "Intentions",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Looking at the login request, guessing it is Laravel based upon XSRF being in cookie and header",
        "Playing with updating genre and viewing feed to discover an error",
        "Opening up SQL Fiddle to explain what I think is going on, its using FIND_IN_SET",
        "Discovering space is a bad character and when this happens using the -- comment is bad",
        "Manually dumping the database with union statements",
        "Using SQL Map showing this SQL Injection",
        "Going over our recon and discovering a v2 admin login endpoint which lets us login with the password hash",
        "Logged in as an admin (Steve)",
        "Talking about Exploiting PHP Object Instanatiations then exploiting ImageMagick",
        "Shell returned, downloading .git, looking at commits and finding Greg's password"
      ]
    },
    {
      "name": "Interface",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Introduciton",
        "Start of nmap, navigating to the page and identifying the framework based upon 404",
        "Playing around looking at javascript source, not getting anything",
        "Playing around with prd.m.rengering-api.interface.htb... I'm guessing file not found is the webserver, not actual code.",
        "Showing the difficulty of dirbusting API Servers",
        "Showing importance of updating FeroxBuster",
        "Playing with the HTML2PDF endpoint and discovering we need to send a POST with HTML as an argument",
        "The PDF Generated has dompdf 1.2.0 in the exif data searching for exploits",
        "Researching how CVE-2022-28368 works, then manually exploiting the vulnerabiltiy",
        "The CSS/Font is created, running the exploit and finding where the Font (PHP File) gets uploaded to",
        "Reverse shell returned",
        "Uploading pspy to examine how the box cleans itself up"
      ]
    },
    {
      "name": "Intuition",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering the application is flask based upon 404 page, showing Werkzeug source to show where the error comes from",
        "Noticing the cookie is odd but since input is escaped, it doesn't look that insecure",
        "Discovering XSS in the Report Submission form and stealing cookies and get a moderator cookie",
        "In the Moderator Panel, set to high priority, xss again to get administrator",
        "Playing with the Report URL on the Create Report Page",
        "Discovering Python URLLib 3.11 has a URL Parsing vulnerability CVE-2023-24329",
        "Getting /etc/passwd, then grabbing the source to the application and discovering FTP Creds, use SSRF to interact with FTP",
        "Shell returned, grabbing the SQLite Database and getting a password",
        "Downloading the source to runner1 off the FTP Server",
        "Using hashcat bruteforce to crack the AUTH_KEY since we know all but the last 4 characters"
      ]
    },
    {
      "name": "Investigation",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Start of gobuster",
        "Discovering an upload form, looking for where things get uploaded",
        "The upload gives us ExifTool output, including the version number to show it is vulnerable to CVE-2022-23935",
        "You should really watch \"The Perl Jam\"",
        "Showing the weird syntax of perl's file open and how | leads to RCE",
        "Back to the box, exploiting and getitng a shell",
        "Reverse shell returned, looking at the uploaded files",
        "Running LinPEAS to discover a cron",
        "There's an outlook email message with an attachment. Copying it then converting to eml format and extracting the file",
        "The file was an windows event log. Using Chainsaw to search through the logs"
      ]
    },
    {
      "name": "Irked",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Last video was missing about 2 minutes and cut off at 31:35.  Sorry, was an extremely busy week and didn't get to verify everything was good.",
        "Begin on Recon",
        "Starting a full nmap scan",
        "Discovery of IRC",
        "Manually looking at IRC",
        "Looking at the IRC to understand how to connect to an IRC Server",
        "Pulling the IRC Version and discovering the exploit",
        "Going into the history of the IRC Backdoor",
        "Manually exploiting the IRC Server",
        "Shell returned on the server",
        "Discovery of .backup which gives a steg password",
        "Logging in with djmardov"
      ]
    },
    {
      "name": "Jab",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Opening Pidgin to register with the Jabber Server then look at chatrooms",
        "Opening the XMPP Console so we can copy users to build the username list",
        "Running Kerbrute against the users to get a few ASREP Roast Hashes",
        "Having issues cracking the hash, need to specify downgrade on kerbrute",
        "Running bloodhound with jmontgomery",
        "Logged into jabber with jmontgomery, discover a new chatroom which has creds to svc_openfire user",
        "Opening bloodhound to discover svc_openfire can ExecuteDCOM",
        "Modifying NXC to allow us to ExecuteDCOM without admin permissions",
        "Using impacket's DcomEXEC to get a shell on the box",
        "Forwarding port 9090 to our box so we can access the OpenFire management website"
      ]
    },
    {
      "name": "Jail",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Recon - NMAP",
        "Recon - Getting Linux Distro",
        "Recon - GoBuster",
        "Analyzing Jail.c source",
        "Begin Binary Exploitation",
        "Verify Buffer Overflow",
        "Create Exploit Skeleton",
        "Finding EIP Overwrite",
        "Adding Reverse TCP Shellcode",
        "Switching to \"Socket Re-Use\" Shellcode",
        "Shell Returned",
        "NFSv3 Privesc Begin"
      ]
    },
    {
      "name": "Jarvis",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of Recon",
        "Running Gobuster and examining the web page",
        "Room.php is the only page that accepts user input, basic testing for SQL Injection",
        "Using wfuzz to fuzz for special characters then getting our IP Banned :(",
        "Unbanned, running wfuzz again and examining unique responses",
        "Showing several ways to test for SQL Injection (subtraction and hex())",
        "Examining the MySQL Query Structure",
        "Explaining Union Injection",
        "Nested queries with union statements",
        "Extracting information out of Information_Schema to databases, tables, columns",
        "Using LIMIT to ensure only one row is returned",
        "Using GROUP_CONCAT to allow us to return multiple rows within union"
      ]
    },
    {
      "name": "Jeeves",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Begin of Enumeration",
        "Avoiding the Rabbit Hole on port 80 (IIS)",
        "Begin of Jenkins",
        "Using Jenkins Script Console (Groovy) to gain code execution",
        "Reverse TCP Shell via Nishang",
        "Reverse Shell returned.  PowerSplit dev branch to find unintended privesc (Tokens)",
        "Powersploit's Invoke-AllChecks completes",
        "Finding Keepass Database using Impack-SMBServer to transfer files",
        "Cracking the KeePass Database",
        "Using KeePass2 to open database",
        "PassTheHash via pth-winexe to gain administrator shell",
        "Grabbing root.txt that is hidden via Alternate Data Streams (ADS)"
      ]
    },
    {
      "name": "Jerry",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Introduction, nmap",
        "Clicking around in Tomcat",
        "Playing around with HTTP Authentication",
        "Bruteforcing tomcat default creds with Hydra and seclists",
        "Sending hydra through a proxy to examine what is happening",
        "Logging into tomcat and using msfvenom + metasploit to upload a malicious war file",
        "Begin of doing this box without MSF",
        "Downloading a cmd jsp shell and making a malicious war file",
        "WebShell returned",
        "Begin of installing SilentTrinity",
        "SilentyTrinity Started, starting listener and generating a payload",
        "Pasting the payload into the webshell"
      ]
    },
    {
      "name": "Jewel",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Introduction",
        "Start of nmap, going into why it needs sudo",
        "Checking Phusion Passenger version",
        "Downloading the source code from port 8000 (GitWeb)",
        "Using Brakeman to analyze the source code to the RAILS App",
        "Checking Rails release date to see it is old",
        "Researching CVE-2020-8165  and checking if our application is vulnerable",
        "Performing the CVE-2020-8165 serialization exploit",
        "Fixing my APT from expired: signature could not be verified because public key is not available NO_PUBKEY",
        "Installing RAILS Then building our deserialization",
        "Reverse shell returned",
        "LinPEAS showed some password hashes, lets check out those files to see if there was more passwords"
      ]
    },
    {
      "name": "Joker",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Port Enumeration",
        "UDP Port Review",
        "TFTP Enumeration",
        "Cracking Squid PW",
        "FoxyProxy Setup",
        "Running Commands",
        "Reverse Shell",
        "PrivEsc to Alekos #1",
        "PrivEsc to Alekos #2",
        "Root #1 (SymLink)",
        "Root #2 (Tar Checkpoint)"
      ]
    },
    {
      "name": "JSON",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Start of recon, NMAP",
        "Using SMBClient to look for OpenShares",
        "Examining the HTTP Redirect on the page",
        "Attemping default credentials",
        "Running GoBuster with PHP Extensions",
        "Examining the /api/ Requests made in BurpSuite",
        "Comparing Requests to notice one has a \"BEARER\" Header.  Researching exactly what it is.",
        "Examining the contents of BEARER/OAUTH2 by base64 decoding it.",
        "Inducing an error message by placing invalid base64, then trying to get a different error message by putting valid but unexpected bas64",
        "See a serialization error, pointing towards JSON.NET, then switching to Windows to install ysoSerial",
        "Creating a .net Deserialization exploit that will ping us",
        "Base64 encoding the exploit, starting tcpdump, and checking for code execution.  Then editing our exploit use a PowerShell webcradle with Nishang to get a reverse shell"
      ]
    },
    {
      "name": "Jupiter",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Using gobuster to enum",
        "Discovering Raw SQL in the HTTP Request, doing some enumeration to discover it is PostreSQL",
        "Looking at the PostgreSQL Copy command, which allows for running commands, getting a shell",
        "Got a shell as the PostgreSQL user",
        "Got a SSH Shell as the PostgreSQL user, then finding port 8888 and enumerating that port",
        "Discovered a Jupityr Notebook, using find to discover what users are doing on the box and seeing Juno has network-simulation.yml",
        "Putting a shell on Network-Simulation.yml and getting a shell as juno",
        "Shell as Juno, looking for jupityr files and discovering the token, which enables us login to Jupityr notebooks and get a shell as",
        "Jovian can run sattrack as as root (via sudo), running strace to discover that it reads the config from /tmp",
        "Editing the sattrick config to download an authorized_keys file to root's .ssh directory",
        "Pretending /root/.ssh didn't exist, getting a shell through cron"
      ]
    },
    {
      "name": "Keeper",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of box",
        "Checking out Request Tracker, login with default creds",
        "Finding a password in the users description on RT",
        "Googling how to get keepass passwords from memory",
        "Talking about how this exploit actually works, its because of the textbox!",
        "Using strings on the dump file to show how the password looks in memory",
        "Searching the keepass, finding a putty private key",
        "Converting the putty key to openssh",
        "Grabbing root"
      ]
    },
    {
      "name": "Knife",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of nmap",
        "Running GoBuster before we start poking at the site",
        "Discover the x-powered-by header says its a weird php version, going to google",
        "Finding a blog post about php-8.1.0-dev being backdoored",
        "Looking at the backdoor",
        "Failing to use the backdoor because of a bad header",
        "Finding the issue, the backdoor uses the header User-Agentt (note the two t's)",
        "Shell returned",
        "Discovering we can run knife with sudo, and finding a GTFOBin"
      ]
    },
    {
      "name": "Kotarak",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "For the unintentional method, I'm just downloading a file versus doing it live on the box because I wanted to save doing it live for another video.",
        "A really good SSRF Presentation: https://www.youtube.com/watch?v=D1S-G8rJrEk",
        "Start of nmap",
        "Accessing port 60000",
        "Manually enumerating ports on localhost via SSRF",
        "Using wfuzz to portscan localhost via SSRF",
        "Tomcat creds exposed & Uploading tomcat reverse shell",
        "Return of shell",
        "Extracting NTDS + SYSTEM Hive",
        "Using HashKiller to crack the hashes",
        "Escalating to Atanas & Identifying wget vulnerability",
        "Starting exploit"
      ]
    },
    {
      "name": "Kryptos",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Begin of Recon",
        "Examining login request while GoBuster runs",
        "Noticing weird behavior by modifying db parameter in login request",
        "Finding what the Error numbers mean. (SQL Error Codes)",
        "Testing if we can trick the application into authentication against us",
        "Starting up metasploit to steal the login hash of a MYSQL Login",
        "Cracking the MySQL Hash with Hashcat",
        "Creating a databse locally for the application to authenticate to",
        "Examining what MySQL Does after authentication in Wireshark",
        "Creating the database structure so the application will authenticate against our database",
        "Begin of the File Encryptor PHP App",
        "Performing a Known Plaintext attack against the RC4 Encryption"
      ]
    },
    {
      "name": "Laboratory",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap, looking at SSL Certificates to get a hostname",
        "Examining the website",
        "Getting git.Laboratory.htb out of the certificate and checking that host",
        "Registering for a GitLab Account then poking at gitlab",
        "Getting the GitLab Version and finding a Vulnerability",
        "Creating two issues, so we can perform the LFI",
        "Using the LFI to extract the application secret then b",
        "Installing a vulnerable gitlab docker so we can build our serialized payload",
        "Starting the docker container, then executing bash inside of it",
        "Changing the docker secret to the one of Laboratory",
        "Restarting with gitlab-ctl restart, then entering the console with gitlab-rails console",
        "Creating the serialization payload"
      ]
    },
    {
      "name": "LaCasaDePapel",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Attempting to execute an VSFTPD Backdoor via MSF",
        "Discovering the backdoor opened 6200, discovering a weird shell",
        "Lets figure out what just happened",
        "Triggering the backdoor without Metasploit",
        "Exploring the Psy PHP Shell opened up by the backdoor",
        "Several functions for executing bash aren't working, checking disable_functions",
        "Attempting to bypass disabled_functions (does not work)",
        "Using ScanDir() and File_Get_Contents(), to explore the filesystem",
        "Identifying we are probably running as the Dali User (Unintended Path)",
        "Downloading CA.KEY, which is a private key to a webserver",
        "Using the CA.KEY to generate client certificates to access the HTTPS Page"
      ]
    },
    {
      "name": "Lantern",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Discovering the Skipper Proxy header, discovering an SSRF CVE",
        "Using FFUF with this SSRF to scan local ports, discover port 5000. Using BurpSuite to add the proxy as our header and discover an internal web service",
        "Discovering an SQLite Injection",
        "Dumping the SQLite Table Schema from our injection, then grabbing data to get the password",
        "Showing an alternate way to get the password, decompiling DLL to discover hardcoded credentials",
        "Looking at the Admin Dashboard, finding a File Disclosure vulnerability",
        "Manipulating a File Upload request, showing we can't just change the filename because we break the serialization, grabbing the Blazor Traffic Processor so we can edit the requests",
        "Creating a malicious DLL, by copying the Logs.dll obtained from file disclosure and putting a reverse shell in it, having a bunch of annoying issues",
        "Reverse shell returned",
        "We can run Procmon with sudo, there's a expect script running nano. Dumping the Write syscall to examine the screen of nano"
      ]
    },
    {
      "name": "Laser",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Running nmap",
        "Discovering port 9100, and poking at it with nmap/pret",
        "Got access to the printer via PRET, dumping print jobs",
        "Running ENT to see the entropy is 7.99 which means it is probably encrypted... Then doing the same thing in Cyber Chef",
        "Discovering the encryption algorithm via inspecting variables on the printer. Then dumping the memory of the printer to get the AES Key and trying to decrypt in Cyber Chef",
        "Cutting up the Print Job with DD to extract the IV/Encrypted payload out of the print job.",
        "CyberChef decrypted our AES! Reading the PDF",
        "Creating the Protobuf object and converting to python",
        "Interacting with Port 9000 with our protobuf payload",
        "Attempting to Pickle a deserialization payload, to see its disabled",
        "Taking the example JSON Data and sending it to port 9000 and finding a SSRF Vulnerability!"
      ]
    },
    {
      "name": "Late",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Time stamps will be added tonight"
      ]
    },
    {
      "name": "Lazy",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Basic Web Page Discovery",
        "Examining Cookies - Pt1 (Burp Sequencer)",
        "Fuzzing Usernames (2nd Order SQL Injection)",
        "Examining Cookies - Pt2",
        "Cookie Bitflip",
        "Oracle Padding Attack - Pt1",
        "Rooting the Box",
        "Oracle Padding Attack - Pt2"
      ]
    },
    {
      "name": "LightWeight",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of recon, Nmap",
        "Taking the CentOS Apache Version to find major version",
        "Running GoBuster with a Common-PHP-Files wordlist.",
        "Enumerating Ldap with ldapsearch",
        "Discovery of Password Hashes within ldap information",
        "Attempting to crack the hashes. (does not crack)",
        "Back to the web page",
        "Page says to login with ip@Lightweight with the password of your ip",
        "Running LinEnum",
        "Discovery of Extended Capabilities set on tcpdump",
        "Performing a packet capture over SSH without touching disk",
        "Examining the pcap created, don't see anything on ens33"
      ]
    },
    {
      "name": "LinkVortex",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering the Forgot Password lets us enumerate valid emails",
        "Using ffuf to enumerate subdomains via virtual host",
        "Discovering .git on the dev subdomain, using git-dumper to download the repo",
        "Discovering cached files in the .git, one of which has a credential",
        "Logged into Ghost, finding the version which shows its vulnerable to CVE-2023-40028",
        "Manually performing the Ghost File Disclosure exploit",
        "Using the public exploit script to leak the ghost config which gives us an SSH Credential",
        "Going over the clean_symlink.h script we can run with sudo, which is vulnerable 3 different ways",
        "Showing the Command Injection vulnerability, because of how the script did the if/then logic in bash",
        "Showing we can bypass the filter by pointing a symlink to another symlink"
      ]
    },
    {
      "name": "Love",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Running nmap against all ports",
        "Attempting to enumerate the initial web page (Voting System)",
        "Nmap finished, checking staging.love.htb from the SSL Certificate",
        "Finding an SSRF Vulnerability in the file scanner",
        "Having trouble using WFUZZ to fuzz all ports",
        "Switching to FFUF and still having trouble to fuzz all ports",
        "Fuzzing takes too long, trying ports from nmap to see if any page is restricted by IP and findig creds",
        "Attempting to use an exploit script for Voting System (More at end of video)",
        "Enough with the exploit script, manually exploiting the application with an image upload",
        "Using Nishang to get a reverse shell, then running WinPEAS",
        "Seeing AlwaysInstallElevated is set on the system, using msfvenom to build an msi"
      ]
    },
    {
      "name": "Luanne",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Introduction",
        "Starting nmap, using min-rate to speed up things and explaining why I don't normally show this",
        "Doing basic recon on /, noticing authentication isn't required everywhere find robots.txt",
        "Taking a look at port 9001, searching for default credentials",
        "Once logged into Supervisord, we can examine processes see HTTP is using LUA",
        "Using FFUF to fuzz the /weather/ endpoint based upon the Supervisord and robots.txt",
        "Using FFUF to fuzz the city parameter of /weather/forecast for special characters",
        "Confirmed injection, failing to get it to work",
        "Going back to FFUF to fuzz for another character after the single quote. We can now inject into the LUA",
        "Reverse shell returned, attempt to crack the hash on my VM and crash my VM... Reboot use John to crack it",
        "Using the webapi_user in order to access the webserver",
        "Looking into the arguments for HTTP Running on port 3001, since we can hit that directly from our reverse shell"
      ]
    },
    {
      "name": "Luke",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of Recon",
        "Checking FTP to get a note",
        "Going to each of the three websites",
        "Running Gobuster on port 80/3000",
        "Taking notes of all the login pages (forgot Ajenti)",
        "config.php found which has a password",
        "Discovering /login on port 3000 accepts username=&password=",
        "Successful login! JWT Token returned",
        "Using curl to add the JWT Token in the header to access other api endpoints",
        "Using BurpSuite to add headers",
        "Navigating the Rest API to dump the usernames and passwords",
        "Attempting logins on other services"
      ]
    },
    {
      "name": "Magic",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Starting GoBuster on the root and images",
        "Finding Auth Bypass via SQL Injection on login then throwing it to SQLMap",
        "Creating a basic PHP Shell, then attempting to upload it",
        "Grabbing the magic bytes off a JPG, then prepending it to our shell",
        "File uploaded, hunting for an LFI and doing more SQLMap",
        "Turns out we don't need the PHP Extension (.htaccess allows anything)",
        "Reverse Shell returned",
        "Grabbing the username and password out of Website Configuration",
        "Using VirusTotal to identify when a file was created",
        "Examining the .htaccess to see why we could execute code (should have a $ at the end)"
      ]
    },
    {
      "name": "MagicGardens",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering the website is built with Django via Wappalyzer or the 404 page",
        "Looking at the Subscription Page, discovering we can change the hostname of the payment processor which is like a SSRF Vulnerability",
        "Making a request to the Payment Processor to see how it responds, building a flask app to mimic the behavior changing the denied message to approved",
        "Had some trouble on our first account, creating a second account to upgrade our subscription",
        "Manipulating the QR Code to add an XSS Payload to steal the cookie",
        "Getting Morty's password from the Django Admin panel and cracking it, then SSH into the box",
        "Looking at the Harvest Binary, opening it up in Ghidra, and dumping dangerous functions with a python script",
        "Cleaning up some functions in Ghidra",
        "Playing with the Buffer Overflow, doesn't seem to work with NC switching to python",
        "Writing an ssh key from the buffer overflow"
      ]
    },
    {
      "name": "Mailing",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap, discovering potential username convention from SSL Certificate",
        "Checking out the website",
        "Examining the request being made to download the PDF and talking about how Metadata can leak if it came from disk or the webapp",
        "Discovering File Disclosure in the download script",
        "Downloading the hMailServer configuration file, to get credentials",
        "Discovering the credentials work with SMTP",
        "Talking about the Moniker Link (CVE-2024-21413) vulnerability and sending a malicious document to Maya to get NTLM Hash",
        "Discovering what Maya can do, nothing interesting in the share but she can WinRM to the server",
        "Discovering LibreOffice 7.4.0.1 is being ran, exploiting it with CVE-2023-2255 to get a shell as admin"
      ]
    },
    {
      "name": "Mailroom",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap, discovering two different OS's",
        "Running Gobuster to bruteforce VHOST",
        "Discovering XSS but nothing we can really do with it",
        "Enumerating Gitea, discovering a repo with some source code",
        "Opening the code with VS Code and Snyk. Discovering a RCE Vulnerability but requires login",
        "Discovering an EAR (Execute After Read) Vulnerability on Authentication",
        "Start of building our Javascript payload to exploit NoSQL Injection, download the internal page",
        "Explaining the NoSQL Injection, then testing with a login bypass",
        "Discovering what happens on invalid logins",
        "Getting the length of the password",
        "Bruteforcing the password with boolean logic"
      ]
    },
    {
      "name": "Manager",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of Nmap",
        "Checking out the website, deciding there isn't much of interest here",
        "Running Kerbrute with a userlist to identify valid users",
        "Showing what Kerbrute is doing with NetExec",
        "A better way to enumerate valid users, RID Bruteforce, showing it with NetExec",
        "Using RPCClient to show how RID Bruteforce works",
        "Using NetExec to bruteforce users with the password of their username",
        "Showing off the NetExec Database",
        "Switching over to testing accounts for MSSQL Access with NetExec",
        "Using Impacket's MSSQLClient to access the MSSQL Server and running XP_DIRTREE to find a backup on the webserver",
        "Finding a credential for Raven in the backup file"
      ]
    },
    {
      "name": "Mango",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap and examining the HTTPS Certificate to get a potential hostname",
        "Doing light testing on the HTTPS Site for SQL Injection, then sending to SQLMap.  Using --force-ssl to make SQLMAP do HTTPS instead of HTTP",
        "Playing with analytics.php and some light testing to see if we could do SSRF.  Put it on the backburner and move on.",
        "Testing the logon prompt on the HTTP Site, playing with SQL Injection and starting another SQLMap",
        "Going over NoSQL Injection",
        "Attempting to explain NoSQL Injection",
        "Performing a NoSQL Injection test via x-www-form-encoded data",
        "Doing Regular Expressions with NoSQL Injection to extract the password length",
        "Explaining how you would have done NoSQL Injection on NodeJS (Sending objects in JSON)",
        "Logging into the webserver via NoSQL Injection, running GoBuster with our cookie that is logged in",
        "Going back to NoSQL Injection with RegularExpression and Boolean injection to extract the password",
        "Going over doing Burp Intruder to extract data"
      ]
    },
    {
      "name": "Mantis",
      "os": "Windows",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Poking at a rabbit hole (8080)",
        "GoBuster to find hidden directory",
        "Finding SQL Creds in hidden directory",
        "Using dbeaver to enumerate database",
        "Impacket-PSExec to Admin",
        "Proving James is not an Admin",
        "Using MSF to Enable Remote Desktop to do Incident Response",
        "Start of Remote Desktop Looking at Event Log + Active Directory",
        "Installing Sysmon to get better logs",
        "Looking at Sysmon Logs"
      ]
    },
    {
      "name": "Mentor",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of Nmap",
        "Enumerating for virtual hosts with ffuf to find the api.mentorquotes.htb page",
        "Talking about FastAPI, attempting to utilize the endpoints but Authentication is required. Create an account",
        "Logging into the endpoint, discovering how to send authentication to the endpoints.  Don't really gain anything",
        "Using ffuf to search for extra endpoints and discover /admin/ but can't do anything",
        "Running NMAP again with UDP to discover SNMP",
        "EDIT: Showing the minrate with nmap to scan UDP much quicker",
        "Using SNMP Walk",
        "Using SNMP-BRUTE to bruteforce other community strings",
        "EDIT: Showing Hydra and OneSixtyOne fail to enumerate the second community string",
        "Using SNMPBruteWalk to dump the SNMP Database, showing how much faster it is than SNMPWalk"
      ]
    },
    {
      "name": "Meta",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Running a VHOST enumeration scan",
        "Discovering the Metaview application which is an image upload",
        "Attempting to exploit the file upload, uploading non images.",
        "Editing the exif metadata to put PHP tags in the image, still failing to get code execution but find XSS",
        "Looking for public exploits against exiftool",
        "Creating a malicious image with CVE-2021-22204 against ExifTool, DjVu exploit",
        "Reverse shell returned, examining the application",
        "Discovering Convert_images directory, using grep to find out if anything uses it and finding a script",
        "Finding the convert_images script uses an old copy of mogrify which uses image magic and has a vulnerability",
        "Exploiting CVE-2020-29599 in mogrify/image magic"
      ]
    },
    {
      "name": "MetaTwo",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Introduction",
        "Start of nmap, attempting to login with FTP then going to the website",
        "Running WPScan with enumerate all plugins in aggressive mode",
        "Taking a look at the site while WPScan runs and finding a plugin (BookingPress-Appointment-Booking) and finding an exploit",
        "Replacing the NONCE in the exploit to get it working",
        "Using SQLMap to dump everything, while we attempt to get only the data we think we are interested in.",
        "Manually dumping the WP_USERS table with the SQL Injection",
        "Cracking the wordpress hashes to get a user credential",
        "EDIT: Playing with SQLMap to get it to dump this database",
        "Searching for Wordpress 5.6.2 exploits, discovering an XXE in WAV Files",
        "Using the XXE to exfil files off the webserver",
        "Discovering FTP Credentials in the WP Config, logging into the FTP Server and finding SSH Credentials"
      ]
    },
    {
      "name": "Minion",
      "os": "Windows",
      "difficulty": "Insane",
      "techniques": [
        "Every time I saw CSRF, I means SSRF.",
        "Begin of Recon",
        "Start of GoBuster",
        "Finding a SSRF",
        "Passing arguments to cmd.aspx via SSRF",
        "Firewall Enumeration",
        "Begin of setting up ICMP Reverse Shell",
        "Begin of sending ICMP Rev Shell to Server (Warning: Lots of Fail)",
        "Return of ICMP Rev Shell",
        "PrivEsc form IIS to Decoder",
        "Unzipping via Powershell",
        "Finding Administrator password hidden in NTFS File Stream"
      ]
    },
    {
      "name": "Mirage",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Exploring NFS which is odd on a Windows Box",
        "Mounting the share with NFSv3, so we can spoof UID's to read any file we want",
        "Using NSUpdate to create a DNS Record for nats-svc.mirage.htb",
        "Running a NATS Server, so we can see clients connect to us when we put the malicious DNS Record in",
        "Failed to modify the code to remove the redaction around password, just grabbing the password from Wireshark since its not encrypted",
        "Grabbing the NATS Client, then using the credentials to connect to NATS and dump messages out of JetStream to get another credential",
        "Edit: Getting claude to fix the code correctly",
        "Running Rusthound, discovering kerberoastable users, getting another credential",
        "Discovering Nathan.AADAM can login to the box, then discovering another user is logged into the box",
        "Talking about the Cross Session Relay attack and then using RemotePotato to steal the logged in users NetNTLMv2 Hash"
      ]
    },
    {
      "name": "Mirai",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Examining some odd behavior. Nmap different result than browser.",
        "Getting to /admin and testing for Zone Transfer",
        "Testing SSH Default Raspberry Pi Creds",
        "Escalate to root 'sudo su'",
        "Recovering the deleted root.txt",
        "Downloading /dev/sdb via SSH",
        "Running Binwalk against it",
        "Trying to recover with TestDisk",
        "Trying to recover with PhotoRec"
      ]
    },
    {
      "name": "Mischief",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Begin of NMAP",
        "Extra nmaps, SNMP and AllPorts",
        "Playing with OneSixtyOne (SNMP BruteForce)",
        "Looking at SNMPWalk Output",
        "Installing SNMP Mibs so SMPWalk is readable",
        "Accessing the box over Link Local IPv6 Address",
        "Looking at Por 3366 (Website), getting PW from SNMP Info",
        "Getting IPv6 Routable Address via SNMP",
        "NMAP the IPv6 Address",
        "Accessing the page over IPv6",
        "Getting output from the command execution page",
        "Viewing Credentials Files and accessing the box via SSH"
      ]
    },
    {
      "name": "Mist",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap which contains pluck version",
        "Looking into CVE-2024-9405 which is a File Disclosure vulnerability",
        "Discovering a backup password, cracking it, then uploading a malicious plugin",
        "RCE Obtained, defender is blocking reverse shell, obfuscating the command to bypass",
        "Creating a malicious LNK file, then when someone clicks on it we get a shell as Brandon.Keywarp",
        "Setting up the Bloodhound Community Edition and fixing bug which isn't showing us any images",
        "Using Bloodhoudn to show we can enroll in various certificate templates",
        "Discovering Defender Exclusions as a low privilege user by reading the event log for event id 5007",
        "Using Certify to request a certificate and then Rubeus to use the pass the ticket attack to get our users NTLM Hash",
        "Explaining our NTLM Relay attack that we are about to do",
        "Installing a version of impacket that allows for shadow_creds within ldap and then setting up the ntlmrelayx to forward connections to the DC's ldap"
      ]
    },
    {
      "name": "Moderators",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap, then going over the website",
        "Examining all the pages on the blog",
        "Looking at the report parameter, doing some light testing for SQL Injection before moving on to IDOR",
        "Using ffuf to bruteforce all reports matching upon a word (phrase) on the page",
        "Attempting to figure out if the md5sum in the logs URL is random by submitting the hash to crackstation",
        "Discovering a file upload vulnerability, faking a PDF and uploading a PHP Shell",
        "When using a PHP Shell System() commands don't work. Uploading PHPInfo to view disabled functions and seeing System is blocked",
        "Getting code execution through Popen() which wasn't blacklisted",
        "Reverse shell returned",
        "Discovering another webserver is running on localhost, turns out to be Wordpress",
        "Exploiting the wordpress plugin BrandFolder to get a shell as Lexi"
      ]
    },
    {
      "name": "Monitored",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Examining the webpage, not finding much",
        "Checking out SNMP, discovering its open with the default community string. Installing MIBS so we can make sense of the data",
        "The process list is in SNMP, explaining how to read this data",
        "Grepping interesting processes discovering there's a bash script that has user credentials in arguments! Attempting to log into Nagios with it",
        "The SVC Account couldn't log in on the GUI, Looking for how to login via an API",
        "Logging into Nagios, discovering it is version 5.11.0 which is vulnerable to a SQL Injection",
        "Manually exploiting this Error Based SQL Injection with XPATH",
        "Using Burpsuite Intruder to dump the TABLES, then edit the columns in burpsuite to show tables easily",
        "The APIKEY is too long to display, using SUBSTRING to grab the APIKEY in multiple requests",
        "Finding a way to register a new user with our API KEY and make them an administrator"
      ]
    },
    {
      "name": "Monitors",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Looking at the webste, getting a VirtualHost and then navigating to the page and confirming Wordpress",
        "The wp-content/plugins directory doesn't have an index, don't even need to use wpscan",
        "Testing the LFI with the plugin",
        "Using wpscan to enumerate wordpress users",
        "Explaining the /proc/ directory and why we can use this to enumerate running processes",
        "Creating a curl script to enumerate all running processes on the box",
        "Pulling apache's configuration to discover another virtual host",
        "Trying the wordpress credentials in cacti for password re-use and then exploiting Cacti with a CVE to get a shell",
        "Manually enumerating the SQL Databases, using /G to select large amounts of data in a human readable format",
        "Discovering the .backup directory in Marcus's home but we can't list contents. Grepping directories for .backup to see if any files are referenced"
      ]
    },
    {
      "name": "MonitorsThree",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Examining Forgot Password to discover we can enumerate usernames and discover an SQL Error",
        "Showing why union injections aren't going to help us, then showing SQLMap",
        "Start of talking about error injection",
        "Dumping the database, table and column information from information_schema via errors caused by EXTRACTVALUE",
        "Logging into the website, not discovering anything really useful to us",
        "Testing our credentials against CACTI, which is version 1.2.26 and vulnerable to CVE-2024-25641",
        "Shell returned, dumping the cacti database to get more credentials",
        "Forwarding 8200 to us, and accessing duplicati's interface",
        "Discovering an auth bypass in duplicate when you have access to the database",
        "Backing up a crontab that has a reverse shell in it, then restoring it to the box and waiting for our shell to come"
      ]
    },
    {
      "name": "MonitorsTwo",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Discovering Cacti version and finding a vulnerability",
        "Sending the payload from the description, discovering we need to set the X-FORWARDED-FOR",
        "Incrementing Host_ID and Local_Data_Ids and discovering different output",
        "Discovering with local_data_ids set to 6 and host_id set to 1, we can get code execution",
        "Showing the python exploit and showing it blindly spray, looking at the Metasploit module for some more info",
        "Getting a reverse shell",
        "Using Script to set up our PTY since python is not installed",
        "Connecting to the MySQL Database and then cracking passwords",
        "SSH into the box with Marcus and discovering mail on the box",
        "Discovering Docker is old and vulnerable to CVE-2021-41091"
      ]
    },
    {
      "name": "Monteverde",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Begin of recon",
        "Using rpcclient with null authentication and dumping active directory users",
        "Building a password list with hashcat --stdout (Forest Video does it better)",
        "CrackMapExec shows SABatchJobs:SABatchJobs are valid credentials",
        "Using SMBMap to list contents of directories",
        "Using SMBMap to download azure.xml which has a hardcoded credential in it then testing with WinRM to see if we can get a shell",
        "Downloading and running Seatbelt on the server",
        "Running WinPEAS for a second opinion",
        "Talking about the Azure Admins group",
        "Playing with SQLCMD to view the MSSQL Database",
        "Downloading and running PowerUpSQL to see if there's any obvious escalation paths"
      ]
    },
    {
      "name": "Multimaster",
      "os": "Windows",
      "difficulty": "Insane",
      "techniques": [
        "Begin of nmap, going over what videos show KRB/LDAP/SMB enumeration",
        "Checking out the web page, finding an API that allows us to search employees",
        "Extracting usernames from the database using the above API",
        "Using wfuzz to fuzz this endpoing and discover there's a WAF that blocks us on BruteFoce and special characters",
        "Sending wfuzz to burpsuite so we can see why the page is giving us an HTTP 415 (hint: Its content-type!)",
        "Using unicode to bypass the bad character list, then launching a super slow SQLMap that never finishes",
        "While SQLMap runs, lets manually exploit this",
        "Found a union injection! Start of creating a Python Script, tons of issues around getting Request to send unicode",
        "Basic script is done, we can now send unicode data via python - Then convert to use the Cmd Module",
        "CmdLoop done, we can now send raw queries to the database.  Lets make an option to do union injection",
        "Script now makes it easy to run UNION Commands and get the output, running through some basic MSSQL Injection to get data from the server"
      ]
    },
    {
      "name": "Napper",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap, showing -vv will cause the output to contain TTL",
        "Checking out the website",
        "Doing a VHOST Bruteforce to discover the internal domain and discovering credentials on a blog post",
        "Checking out the NAPListener blog post, which gives us a way to enumerate for the NAPLISTENER Implant",
        "Showing the Backdoor code to discover how it works",
        "Building a DotNet Reverse Shell and renaming the method to Run, then using Mono (mcs) to compile",
        "Converting the DLL to base64 and getting NAPLISTENER to execute it",
        "Discovering a draft blog post talking about them getting rid of laps and building a custom solution that uses elastic",
        "Setting up a tunnel with Chisel so we can talk to Elastic",
        "Using curl to enumerate Elastic",
        "Reversing the Golang binary with Ghidra"
      ]
    },
    {
      "name": "Nest",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Showing why we should run NMAP as root or sudo.",
        "Running nmap to see only SMB is open, start a full port scan and move on",
        "Enumerating SMB (Port 445) with CrackMapExec, SMBClient, and SMBMap to explore how each program works",
        "Running SMBClient to mount the share",
        "Installing CIFS-Utils so we can mount SMB and run commands like find against the share",
        "Discovering a password, doing a credential spray and getting some odd results",
        "Mounting the shares with as TempUser to discover we have access to more files",
        "Using iconv to cat a windows text file because it showed a bunch of bad characters",
        "Viewing the NotepadPlusPlus files to see the path of a file in the Secure$ Directory, we can get into this folder",
        "Downloading the source-code to RUScanner in the User share",
        "Switching to Windows so we can use Visual Studio to compile the RUScanner application and decrypt the password"
      ]
    },
    {
      "name": "Netmon",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Begin of Recon",
        "Searching for good files to view via FTP",
        "Nothing really found, searching for where PRTG creation file is",
        "Backup configuration found!",
        "Logging in by incrementing the password from 2018 to 2019",
        "Searching for CVE's",
        "Searching for where to send notification emails like CVE Said",
        "Testing for Command Injection via Cmd",
        "Testing for Command Injection via Powershell",
        "Getting a reverse shell",
        "Encoding powershell in Base64 to eliminate potential bad characters",
        "Getting a reverse shell"
      ]
    },
    {
      "name": "Networked",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Begin of recon",
        "Looking at the website, checking source, robots.txt, etc",
        "Using GoBuster with PHP Extensions as HTTP Header said it had PHP Enabled",
        "Writing a simple PHP Code Execution script and trying to upload it",
        "Discovery of backup.tar, examining timestamps between downloading with wget/firefox",
        "Searching php scripts for superglobals as that will show user-input",
        "Explaining what magic bytes are",
        "Using PHP interactive mode to demonstrate what is happening",
        "Showing error codes are different based upon where image validation failed",
        "Uploading a malicious PHP Shell",
        "Navigating to our php shell and getting a reverse shell"
      ]
    },
    {
      "name": "Nibbles",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of Recon",
        "Finding hidden directory via Source",
        "Downloading NibbleBlog to help us with finding version information",
        "Identifying what vresion of NibblesBlog is running",
        "Using SearchSploit to find vulnerabilities",
        "Examining the Exploit",
        "Explanation of exploit",
        "Attempting to find valid usernames for NibblesBlog",
        "Finding usernames in /content/private",
        "Using Hydra to attempt to bruteforce",
        "Oh crap. Hydra not good idea we're blocked...",
        "-- Some minor panicing about how to continue"
      ]
    },
    {
      "name": "Nightmare",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Edit: Whoops forgot @stefano_118 helped create this machine!",
        "Start of Recon",
        "/documents and /secret rabbit hole enumeration",
        "Using wfuzz on the /secret rabbit hole to find argument for download.php",
        "Begin of Web Application Enumeration, some XSS Found",
        "Throwing bad characters in username and finding Second-Order SQL Injection.",
        "Begin of Union Injection to dump the database via second order sql injection",
        "Dumping users and passwords from SysAdmin table and using Hydra to bruteforce SSH",
        "Enumerating SFTP (Using SSHFS to Dump a File Listing)",
        "Converting 64-Bit SFTP Exploit to 32-Bit",
        "Reverse Shell Returned, some stuff and finding Set-GID Binary",
        "Reversing SLS binary with Radare2 (r2)"
      ]
    },
    {
      "name": "Nightmarev2  - Speed Run/Unintended Solutions",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Original Video with In-Depth Explanations of Intended Solution: https://youtu.be/frh-jYaUvrU",
        "End of intro, Start of nmap",
        "Playing with Second-Order Union Injection",
        "Dumping all users",
        "Converting SFTP Exploit from 64bit to 32bit",
        "Reversing SLS Binary",
        "Kernel Exploit",
        "First Method - Executing ELF Binaries from memory (Reflective loading elf)",
        "Second Method - Crashing a program to create a write-able file."
      ]
    },
    {
      "name": "Nineveh",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin Recon (NMAP)",
        "GoBuster HTTP + HTTPS",
        "Accessing Pages",
        "Using Hydra against HTTP + HTTPS Web Forms",
        "Logging into HTTP and hunting for vulns",
        "Second Hydra attempt against HTTPS",
        "Logging into HTTPS (phpLiteAdmin)",
        "Chaining Exploits to get Code Execution",
        "Reverse Shell Returned",
        "LinEnum.sh Script Review",
        "Watching for new Processes"
      ]
    },
    {
      "name": "Nocturnal",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Running gobuster to find PHP Files",
        "Uploading a file and playing with the file upload functionality",
        "Playing with the username variable, discovering we can list files of other users",
        "Fuzzing usernames to see if any other user has uploaded files, getting an document that contains a password for amanda",
        "Logging in as Amanda, who has access to admin. It gives us a way to look at source code",
        "Looking at the sanitization function, finding a dangerous non-blocked character (new line) which gives us command injection",
        "Using curl to download and execute a shell",
        "Got a shell on the box, dump the database, crack passwords and discover Tobias's password",
        "Discovering an application on port 8080, using SSH to forward the port and logging into ISPConfig application",
        "Exploiting the ISPConfig Application with a known CVE"
      ]
    },
    {
      "name": "Node",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of NMAP",
        "GoBuster (Fails)",
        "Screw GoBuster, BurpSpider FTW",
        "Examing Routes File to find more pages",
        "Finding Credentials and downloading backup",
        "Cracking the zip with fcrackzip",
        "Finding more credentials (SSH) within MongoSource",
        "Privesc to Tom User",
        "Analyzing Backup Binary File",
        "Using strace to find binary password",
        "Finding blacklisted characters/words",
        "Unintended method one, abusing CWD"
      ]
    },
    {
      "name": "Noter - Cracking Flask Cookies and performing MySQL Raptor Exploit on Modern Distro RCE",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Registering an account",
        "Enumerating valid usernames based upon error message",
        "Using ffuf to match regex to enumerate valid usernames",
        "Poking at the web applicaiton trying IDOR/SSTI and failing",
        "Looking at the cookie given by the application and discovering it is a Flask Session Cookie",
        "Trying to crack the Flask Session with Hashcat. It fails because I think the payload is too long for hashcat.",
        "Using Flask-Unsign to crack the session",
        "Using flask-unsign to forge a cookie that says we are the Blue User",
        "Logged into the application as Blue, get the ftp_admin password",
        "Unzipping the source code that came from the ftp server and using diff to compare the two versions"
      ]
    },
    {
      "name": "Obscurity",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Quick rant about Security through Obscurity and why it can be good",
        "Begin of nmap'ing the box",
        "Checking out the webpage, GoBuster giving weird errors, try WFUZZ",
        "Taking a deeper look at the website while we have some recon running",
        "Wfuzz found nothing hunting for /$directory/SuperSecureServer.py",
        "Doing some Directory Traversal attempts against the webserver, and seeing it looks like its vulnerable",
        "Extracting the source code to the webserver by specifying /../SuperSecureServer.py",
        "Installing VS Code so we can run this webserver and insert breakpoints",
        "Creating main.py then running the code in VSCode",
        "Exploiting the exec() statement in the WebServer",
        "Explaining that we can't use + for spaces in the url, have to do %20, then testing a reverse shell"
      ]
    },
    {
      "name": "October",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Twitter @ippSec",
        "Low Priv: Default Account + File Upload",
        "PrivEsc: Return to LibC + ASLR Bruteforce",
        "Pulling up Web Page.",
        "Searchsploit",
        "Enumerating Version (Download Versions, Hash Static Files)",
        "Default cred /backend -- Upload Shell",
        "User Reverse Shell",
        "Transfering file over nc",
        "Begin \"fuzzing\" Binary",
        "GDB Analysis",
        "Get a full reverse shell with tab autocomplete."
      ]
    },
    {
      "name": "Office",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Testing the XAMPP PHP Vulnerability, which doesn't work",
        "Getting the Joomla Version from the manifest, then exploiting CVE-2023-23752 to get the MySQL Password (same as devvortex)",
        "Using KerBrute to bruteforce valid usernames and then NetExec to spray the MySQL Password to get DWOLFE's password",
        "Examining the PCAP on the FileShare then building a Kerberos Hash for ETYPE 18",
        "Logging into Joomla then getting a shell through editing a template",
        "Looking at the other VHOSTS on the box, discovering a site running on localhost",
        "Discovering an old version of LibreOffice, exploiting CVE-2023-2255 to get a shell",
        "Showing another way, since TSTARK can edit the registry to allow macros to run then just sending a malicious document",
        "Pillaging DPAPI with the RPC flag, since we don't know the password and gained access to an interactive login",
        "We have the ability to edit GP as HHOGAN, using SharpGPOAbuse to create a local admin"
      ]
    },
    {
      "name": "Olympus",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of Recon, nmap filtered explanation",
        "Begin of initial DNSRecon, hunting for a domain name",
        "Web page enumeration, finding xdebug in header",
        "Installing xdebug plugin in Chrome to show its use",
        "Getting a reverse shell on the first docker (Icarus)",
        "Setting up nginx to accept files uploaded over HTTP / WebDav",
        "Examining the Wireless Capture from Icarus",
        "Cracking WPA with aircrack / hashcat",
        "Decrypting WPA traffic in Wireshark",
        "Enumerating valid usernames via SSH (CVE-2018-15473)",
        "SSH into port 2222 with information from Wireless Capture",
        "Domain Name found!  Time to do a DNS Zone Transfer"
      ]
    },
    {
      "name": "Omni",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Begin of nmap",
        "Finding out this is Windows IOT",
        "Showing the BlackHat paper on Hacking Windows IOT",
        "Trying SirepRAT out against this box",
        "Finally getting code execution witht he SirepRAT tool, trying to run powershell",
        "Finally getting Powershell working, trying to get a Reverse Shell",
        "Getting a Reverse shell by downloading NC64.EXE and running it",
        "Reverse shell returned",
        "Extracting the SAM/SYSTEM Registry hive so we can run SECRETSDUMP to pull user hashes",
        "Had trouble with Impacket's SMB Server, editing smbd.conf",
        "Getting a shell as APP using the website, so we can decrypt the user.txt and iot-admin.txt secure strings"
      ]
    },
    {
      "name": "OneTwoSeven",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Begin of recon",
        "Examining the webpage",
        "Discoving SFTP Credentials on the web page",
        "Playing with the SFTP Server",
        "Discoving the SymLink command to break out of home directory",
        "Symlinking the root directory to find the source of login.php through VIM SWP Files.",
        "Second way to get source code, symlink with a file naming ending in not PHP",
        "Examining the source code to login.php and getting a hard coded username",
        "Examining index.php to see how to access a login portal (admin)",
        "Using SSH to do port forwarding (Reddish)",
        "Examinig the admin web page",
        "Examing the Apache Rewrite Engine Rules"
      ]
    },
    {
      "name": "OnlyForYou",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering beta.only4you.htb",
        "Downloading the source, scanning with Snyk and discovering a File Disclosure vuln",
        "Demonstrating that os.path.join in python will do unexpected things if a path begins with slash",
        "Failing to get /proc/self/environ, not sure why we failed here",
        "Grabbing the nginx configuration to discover where the websites are stored, using the File Disclosure Vuln to leak source of main website",
        "Discovering a vulnerability when sending mail",
        "Talking about how we will bypass the bad character check, the Re.Match will only match the start, not entire string",
        "Getting code execution from the contact form",
        "Reverse shell returned, looking for databases, and discovering a few ports listening on localhost",
        "Uploading Chisel so we can access ports 3000 and 8001"
      ]
    },
    {
      "name": "Oouch",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start the box checking out nmap, seeing an FTP Server with a file hinting at OAUTH",
        "Poking at the login for the flask application (Port 5000)",
        "Playing with the Change Password fied, made a mistake which puts me down a rabbit hole",
        "Checking the Contact page, seeing we get banned with a XSS Attempt but someone will click URL's if we send them",
        "Creating an account on Authorization.oouch.htb",
        "Enumerating the /token/ an endpoint through error messages",
        "Using the webapp to give our authorization account access to our consumer account",
        "Going through the same workflow to give authorization access to consumer account, but tricking a different user into going to the last piece of the workflow",
        "We are now the QTC User! Going into the Documents shows some hints like a develop credential",
        "Reading the Django Docs to see how the oauth endpoints are setup, finding the application register endpoint and the develop creds to again access",
        "Looking at the oauth authorization workflow again in order to build a authorization link for our new application!"
      ]
    },
    {
      "name": "OpenAdmin",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Running GoBuster to discover /music/, checking the page to try to find out what it is.",
        "Going to login reveals this is OpenNetAdmin version 18.1.1, searchsploit isn't updated and fails to find the correct exploit",
        "Showing what to do when an web exploit script gives HTML",
        "Finding the correct exploit script, setting it to go through burpsuite",
        "Failing to get a reverse shell for a bit because of bad characters (explained at end, we needed to URL Encode it).",
        "Reverse shell worked when doing the python one.",
        "Running LinPEAS",
        "Looking for a config file with database connection info",
        "Exploring the MySQL Database to get additional creds",
        "Running Medusa to test the passwords against users on the box to discover we can login as jimmy",
        "Showing of \"sucrack\" to brute force with \"su\" incase SSH Was not open"
      ]
    },
    {
      "name": "OpenKeyS",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Introduction",
        "Begin of nmap",
        "Nmap shows it is BSD, going over some command differences",
        "Running GoBuster to find other PHP Scripts",
        "Looking at the includes directory and finding source code",
        "Reversing the Check_Auth binary with Ghidra, to see it doesn't decompile well",
        "Using VirusTotal to find out if this an old binary",
        "Using Cutter to decompile this binary, to see it does a better job than Ghidra!",
        "Finding some BSD Exploits related to authentication",
        "Putting SCHALLENGE as the username, causes a different error message. Then doing some code analysis around $_REQUEST",
        "Abusing the $_REQUEST() feature to overwrite the username file with a valid user and grab their SSH Key",
        "Showing how OpenBSD has some different command line switches"
      ]
    },
    {
      "name": "OpenSource",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Identifying a Docker exists based upon the Python Version in NMAP + SSH Version [MasterRecon]",
        "Navigating to the website downloading the source code available, there is a git folder switching branches",
        "Discovering a vulnerability in the os.path.join command, if we prefix our path with a slash it will overwrite the entire path",
        "Attempting to upload a malicious cron, docker isn't running cron so it doesn't work",
        "Adding a new route to the application to execute commands",
        "Able to run commands and get the output",
        "Creating an endpoint to send reverse shells in the webapp",
        "Reverse shell returned",
        "Looking at port 3000 which was previously filtered. Looks like its a Gitea interface but we don't have creds",
        "Uploading Chisel and tunneling to access the website"
      ]
    },
    {
      "name": "Ophiuchi",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap, looking at release date of tomcat",
        "Starting a bruteforce of /manager login to run in the background",
        "Playing with the YAML Parser, sending special characters leads to a stack trace showing the library",
        "Testing a YAML Deserialization payload for Snake YAML",
        "Start of weaponizing the payload",
        "Having a lot of trouble with building out a payload due to special characters",
        "Making it simple, just downloading a script then executing it",
        "Finally got a shell",
        "Going into how we know the sudoers file is non-default by date or filesize",
        "Finding out install date of a linux machine by SSH Host Key",
        "Finding where tomcat is installed and then grabbing the password out of the config tomcat-users"
      ]
    },
    {
      "name": "Optimum",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Go to HTTPFileServer",
        "Explanation of Vulnerability",
        "Testing the Exploit",
        "Getting rev tcp shell with Nishang",
        "Shell returned",
        "Finding exploits with Sherlock",
        "Using Empire Module without Empire for Privesc",
        "Start of doing the box with Metasploit",
        "Reverse Shell Returned (x32)",
        "MSF Error during PrivEsc",
        "Reverse Shell Returned (x64)",
        "Same PrivEsc as earlier, different result"
      ]
    },
    {
      "name": "Ouija",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Fuzzing the API port port 3000 with ffuf",
        "Discovering the Gitea Domain and seeing a repo which discloses HA Proxy 2.2.16 is in use",
        "Exploring CVE-2021-40346 an integer overflow in HA Proxy which enables HTTP Smuggling",
        "Putting a 3rd request in to make the HTTP Smuggle reliable and grabbing the source code to app.js",
        "Taking a look at the APP.JS source code and discovering a Hash Length Extension attack",
        "Performing the Hash Lenght Extension attack and then using FFUF to find the length of the secret",
        "Have another File Disclosure, chaining it with the /proc symlink to read an SSH key to get shell on the box",
        "Discovering port 9999",
        "Opening the PHP Library up in Ghidra and discovering an integer overflow",
        "Creating a C Program to explain the integer overflow"
      ]
    },
    {
      "name": "Outbound",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Logging into RoudnCube with the assume breach credentials, getting the version and searching for exploits",
        "Running the CVE-2025-49113 POC to get a shell on the box",
        "Taking a step back and just examining the payload for the POC and talking about the attack a little",
        "Logging into MySQL and poking at the database",
        "Looking at the Sessions Table and discovering the password is stored encrypted in the session.  Decrypting it with the Roundcube utility",
        "Showing how to decrypt the data manually via cyber chef",
        "Logged in, discovering we can run Below with Sudo, seeing the source code is on the box and looking at the version",
        "Exploiting Below version 0.8.0 via CVE-2025-27591"
      ]
    },
    {
      "name": "Outdated",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Running nmap",
        "Running CrackMapExec to enumerate the share",
        "Talking about a common misconception about \"Null SMB Authentication\"",
        "Downloading a PDF off the open share",
        "Using SWAKS to send an emailw ith a link to see if anything clicks it",
        "Exploring the CVE's mentioned in the PDF to see one of them is Folina",
        "Someone clicked our link! The User Agent Shows WindowsPowerShell/5.1.19041.906, which leaks the patch level of the box",
        "Building a Folina Payload",
        "Using ConPtyShell as our payload for Folina, so we have a proper PTY with tab auto complete on windows rev shells",
        "Reverse Shell obtained, discover we are btables and a little enumeration shows we are in a HyperV Container",
        "Running SharpHound"
      ]
    },
    {
      "name": "Overflow",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Taking a look at the website",
        "Examining the AUTH Cookie and talking about why its unique",
        "Running FeroxBuster, talking about why I started using it",
        "Examining the length of the cookie with various usernames to discover the cookie length changes",
        "Discovering the block size",
        "Modifying the cookie and getting an Invalid Padding error message. Which indicates it may be vulnerable to Padding Oracle",
        "Running padbuster to perform the Padding Oracle attack and decrypt the cookie.  Then creating a new cookie changing our username",
        "Changing our cookie to the forged one and logging into the application as Administrator",
        "Finding an SQL Injection in the Logs endpoint, using SQLMap to dump everything",
        "Going over the SQLMap history files to view previously dumped data, so we don't have to make more requests to the server"
      ]
    },
    {
      "name": "Oz",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of the box",
        "Attempting GoBuster but wildcard response gives issue",
        "Start of doing wfuzz to find content",
        "Manually testing SQLInjection",
        "Running SQLMap and telling it exactly where the injection is",
        "Manually extracting files with the SQL Injection",
        "Cracking the hash with hashcat",
        "Start of examining the custom webapp, playing with Template Injection",
        "Explaining a way to enumerate language behind a webapp",
        "Reverse Shell returned on first Docker Container",
        "Examining SQL Database",
        "Doing the Port Knock to open up SSH"
      ]
    },
    {
      "name": "Pandora",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of nmap",
        "Using nmap to scan NMAP",
        "Doing a SNMPWalk talking about SNMP Mibs and how to install them, then using snmpbulkwalk to speed up the scan",
        "Finding all the unique fields in our SNMPWalk with grep, sort, and uniq.  Which helps find fields of value",
        "SNMP Allowed us to view running processes on a box, a password was in the argument so we can ssh in",
        "SSH into the box and looking at the webserver files and configs",
        "Looking at Apache's config seeing there's a different site available to localhost, doing a SSH Tunnel to access it",
        "Finding an unauthenticated pandora fms exploit via google, playing with the injection manually",
        "Using SQLMap to automatically dump the database of pandora",
        "Testing sessions, should have used wfuzz or something to test all of these quickly",
        "Using the union injection to login as admin by placing a php serialized object that it expects"
      ]
    },
    {
      "name": "Paper",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of nmap",
        "Checking out what version of Centos is running",
        "Running Feroxbuster and GoBuster",
        "Noticing a X-Backend-SErver header that leaks the virtual host Office.Paper",
        "Showing my favorite nmap script Banner-Plus",
        "Office.Paper is wordpress, running wp-scan",
        "Discovering a vulnerability that lets us read posts that are in drafts, finding a Rocket Chat Server",
        "Discovering a Rocker Chat Bot finding an LFI and getting a password which we can use to ssh",
        "Looking at the ps output of the server to see who the bot runs as",
        "Running LinPEAS",
        "Finding out it is vulnerable to CVE-2021-3560 Polkit Privilege Escalation"
      ]
    },
    {
      "name": "Passage",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Identifying this is likely Ubuntu Xenial",
        "Attempting basic SQL Map",
        "Failing to find a way to enumerate CuteNews version",
        "Looking over an exploit script from SearchSploit",
        "Finding there is a page that exposes a bunch of user hashes... wat?",
        "Copying a bunch of PHP Blobs, then using grep to only show us the hashes",
        "Going back to looking over the exploit script",
        "Sent the exploit script through burpsuite and looking at each request",
        "Getting a reverse shell and fixing out TTY",
        "Searching CuteNews PHP Files for passwords"
      ]
    },
    {
      "name": "Patents",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Begin of nmap, there's a weird 8888 port.",
        "Looking at the website, downloading a docx",
        "Finally running GoBuster, doing the raft wordlist because it has \"UpdateDetails\"",
        "Running GoBuster against the \"release\" directory to get release notes and researching XML and DocX",
        "Adding an XXE Payload into our Word Document: customXml/item1.xml",
        "Making an XXE Chain to extract files using HTTP and PHP's Encoder",
        "Extracting the Apache Config to see DocRoot, then extracting config.php",
        "Exploring LFI Injection into getPatent_alphav1.0.php, explaining what happens with bad regex to remove things.",
        "Exploring Log File Poisoning",
        "Shell returned on the box, fixing up the TTY and searching for files by creation time",
        "There's a file in /opt/, that hints at a cronjob running a task every minute.  Running PSPY to see the process creation"
      ]
    },
    {
      "name": "PC",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Googling the port number, and reading more about gRPC",
        "Install GRPCurl so we can access the gRPC interface",
        "Enumerating the grpc interface",
        "Registering a user and logging in",
        "Using Verbose with GRPCurl to get extra information which includes an JWT",
        "Discovering an SQL Injection in the SimpleApp.GetInfo, enumerating the database to discover SQLite",
        "Enumerating the SQLite Database (similar to Information_schema with mysql)",
        "Using Group_Concat with a union injection to dump all users and passwords, then SSH into the box",
        "Discovering PyLoad is running on localhost, setting up an SSH Tunnel to access it",
        "Finding a public POC and running it to exploit PyLoad"
      ]
    },
    {
      "name": "Perfection",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering the Weighted Grade Calculator which we will exploit",
        "Using FFUF to enumerate all bad characters and discovering we can't send any symbols",
        "Quick bash one liner with JQ to URL Encode each line of our wordlist",
        "Discovering a New Line character breaks the search for Bad Characters, then getting a shell on the box",
        "Shell returned, looking at the source code and seeing the \"Bad Character\" filter was really a regex whitelist",
        "Discovering mail that says the password format in the database",
        "Using hashcat Bruteforce mode to crack the password"
      ]
    },
    {
      "name": "PermX",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Using FFUF to fuzz for virtual hosts (sub domains)",
        "Discovering the LMS Sub Domain which hosts Chamilo, talking about enumerating versions of opensource applications",
        "Start of talking about pulling MD5's of every file in a .git, so we can see when a file got introduced",
        "The bash one-liner for searching git for an MD5 is done, looking at when the date of commit was.",
        "Turning our one-liner into a bash function then putting it in BashRC",
        "Hunting for an exploit, finding python script to see how it works. Just using curl to upload the file to make sure we understand what the python script is doing",
        "Shell returned, looking for the configuration, finding a user has the same password as the database password",
        "The MTZ User can run a bash script with sudo, looking at it and discovering it is vulnerable to symlinks",
        "Creating a symlink to sudoers, running sudo to give us write access, then allowing us to run sudo all",
        "Showing that we cannot replace SetUID Binaries because the SetUID permission gets removed when being written to by non-file owner"
      ]
    },
    {
      "name": "Perspective",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Start of nmap",
        "Looking at the website, looks like there's different behavior for extensions",
        "Registering and logging into an account",
        "An unintended way to login, IDOR within the Forgot Password logic, can change usernames",
        "Uploading a new product, test XSS, File Upload",
        "Using FFUF with a raw http request to test for potential extensions",
        "Using SHTML to test for Server Side Inclusion SSI and leaking web.config",
        "Going over the web.config, pulling out sensitive things",
        "Decrypting the .aspx Forms Ticket and forging a new one that states we are admin",
        "The Admin page allows us to generate PDF's, testing for XSS",
        "Attempting to redirect the save to pdf function with a meta tag"
      ]
    },
    {
      "name": "Phoenix",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Taking a look at the SSL Certificates and website to find blog/forum",
        "Running WPScan, explaining why i like aggressive scanning",
        "Finding public vulnerability in Asgaros Forms (Blind Time Based SQLi)",
        "Running SQLMap to confirm the injection",
        "Examining the Wordpress Database structure, so we can run SQLMap to dump very specific things",
        "Cracking wordpress credentials to find out we can't use any because of MFA",
        "Using our SQL Injection to dump a list of activated plugins in wordpress",
        "Finding an exploit in the Download From Files plugin, converting it to ignore SSL Validation Errors",
        "Uploading a malicious phtml (php) file to get a shell on the box",
        "Examining how MFA is enabled on SSH/SU by looking at PAM files"
      ]
    },
    {
      "name": "Photobomb",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Discovering this is a ruby Sinatra Web App based upon error message",
        "Discovering credentials in javascript",
        "Examining the HTTP Request to resize images and discovering an RCE",
        "Getting a reverse shell",
        "Discovering we have SETENV with sudo on a script, checking for path injection",
        "Exploiting path injection with the find command",
        "Exploiting path injection because the script disables some Bash Built-ins",
        "Explaining bash built-ins"
      ]
    },
    {
      "name": "Pikaboo",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Discovering the webserver is apache, despite nmap saying it is nginx",
        "Every request with /admin gets a 401, indication that nginx location may not end with /",
        "Doing the nginx lfi to grab apache server-stats and leak the /admin_staging/ directory",
        "Running gobuster in /admin_staging/ to discover more php scripts",
        "Testing index.php for lfi with a php filter",
        "Looking at the source and seeing it is using include() which allows for RCE if we can get it pointed at php code",
        "Playing with the LFI, eventually finding info.php which tells us open_basedir is set to /var/ which prevents the LFI from going out of that directory",
        "Using wfuzz with an LFI wordlist to search for files we can chain with this LFI, discovering ftp logs",
        "Poisoning the FTP log with a php reverse shell then using the LFI to trigger it",
        "Looking at the /opt/pokeapi directory to find a LDAP credentials"
      ]
    },
    {
      "name": "Pikatwoo",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Identifying all the technologies used in the box",
        "Looking at OpenStack Keystone Authentication and discovering CVE-2021-38155",
        "Pulling up API DOCS to see how to login to Keystone, then testing lockout",
        "Taking the Burpsuite Request, sending it to FFUF and using a trick to try each password multiple times",
        "Attempting to access Swift as a vendor to bypass auth, using GoBuster and discovering an Android directory with Pokatmon app in it",
        "Start of analyzing the Pokatmon App, examining DNS, setting up a MITM with Burpsuite and Socat",
        "Using Frida to disable TLS Certificate Pinning on Flutter",
        "Discovering the App Signs every request, grabbing the certificate out of the app, and signing our own request",
        "Performing an SQL Injection, getting an email address then looking for vulnerabilities in Forgot Password on the main website",
        "Discovering CVE-2021-43557 in APISIX, which gives us an idea to URLEncode Paths to bypass blacklists and gaining access to the /private/ directory which has a /forgot-password we can use to reset Roge"
      ]
    },
    {
      "name": "Pilgrimage",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Uploading an image file and trying to identify how the upload works",
        "Running Git-Dumper to download the exposed .git directory, taking a look at the source code",
        "Looking at the ImageMagick version (7.1.0-49) and seeing it is vulnerable to CVE-2022-44268",
        "Generating a malicious image and downloading the sqlite database",
        "Doing a PS and seeing inotifywait is being used to run a bash script when files created in web directory",
        "Showing why the bash script is not vulnerable",
        "Finding a binwalk exploit for version 2.3.2, which takes advantage of path traversal in PFS files",
        "Taking a look into the exploit to see how it works",
        "Showing the PFS File Format"
      ]
    },
    {
      "name": "Pit",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Intro the important thing about this box is recon",
        "Start of nmap discovering an nginx server header",
        "The SSL Certificate leaks an important hostname",
        "Running an SNMPWalk which has a bunch of important information, notably the HTML Directory",
        "Discovering the SeedDms51x Directory, trying to enumerate version (Failing)",
        "Creating a python script to help with bruteforcing",
        "Script done, looking at SNMP to get other usernames",
        "Brutefocing michelle's password to get in and seeing the SeedDMS Version",
        "The SeedDMS Patch used htaccess, server is nginx so its still vulnerable.  Uploading a shell",
        "Grabbing the MySQL Password from SeedDMS Config and trying it against other services. Gain access to cockpit which gives access to michelle user",
        "The SNMP is executing a program every time snmp is ran, we can trick SNMP to execute our code to get root",
        "Start of Explaining SELinux"
      ]
    },
    {
      "name": "PivotAPI",
      "os": "Windows",
      "difficulty": "Insane",
      "techniques": [
        "Start of nmap, downloading files over FTP",
        "The contents of all the PDF's don't really help. Using exiftool to extract authors.",
        "Using Kerbrute to bruteforce valid users and getting ASREP Hash. It is ETYPE 18, which hashcat doesn't support. Use downgrade to generate ETYPE 23 and crack the hash",
        "Going into what ETPE Means",
        "Using CrackMapExec to dump a list of file shares, then using Spider_Plus plugin to dump files",
        "Doing some JQ Magic navigate the Spider_Plus data",
        "Converting the Outlook Message Files (MSG) to plaintext with msgconvert",
        "Running Restart-Oracle.exe with Process Monitor to find out the process is writing to a TEMP Directory",
        "Removing delete permissions on the Windows Temp Directory, so the Restart-Oracle program can't delete the files out of temp, finding based64 and getting another EXE",
        "Running the extracted executable with Process Monitor to discover it loads dotnet",
        "METHOD 1: Opening the extracted executable in x64debug, setting it to break upon EXIT then examining its memory to find the dotnet executable"
      ]
    },
    {
      "name": "Pivoting Update: Granny and Grandpa",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Really wanted to show people this method of pivoting, but ran into issues last video.  This video doesn't explain any exploits, just uses plink.exe to set up a tunnel which we can use as a gateway for",
        "If you wanted to see the explanations behind exploits check out the original video: https://www.youtube.com/watch?v=ZfPVGJGkORQ",
        "Apologies for any confusion/wasted time."
      ]
    },
    {
      "name": "Planning",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Using gobuster to discover the VHOST and running into a minor issue, I think gobuster changed how it handles the domain on VHOST Scans.",
        "Looking at the Nuclei Results",
        "Using the append-domain (ad) flag in gobuster to allow our VHOST scan to work and discovering the Grafana subdomain",
        "Discovering Grafana is running 11.0.0 and searching CVE's",
        "Finding CVE-2024-9264, and running it to get a shell on the Grafana docker container",
        "Looking at the env variables, discovering a credential that works to SSH into the box",
        "Looking at the crontab.db file, discovering a password",
        "Forwarding localhost:8000 back to us, so we can hit crontab-ui and logging in and creating a malicious cron to get root",
        "Showcasing FFUF to bruteforce HTTP Login by using bashful to append a string to our fuzz list and also use an encoder to b64 encode"
      ]
    },
    {
      "name": "Player",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Begin of recon, wireshark nmap to see how it identified the hostname.  The way this box is configured apache is placing the hostname when the \"Host: \" HTTP Header is not present.",
        "Starting a bunch of automated tools. Nmap all ports, and gobuster to discover VHOST (virtual hosts) and files.",
        "Checking dev.player.htb and identify the framework (Codiad) is being leaked in some javascript",
        "Checking chat.player.htb, nothing really here just hints at source code disclosure on other domains",
        "Checking staging.player.htb, sending an email leaks some interesting files",
        "Checking player.htb/launcher, entering an email leaks some other PHP Files along with a JWT Token",
        "Discovering backup files, showing BurpSutie Pro can do it but I had added this feature in GoBuster",
        "Going over exactly what I did in GoBuster to add the DiscoverBackup feature",
        "Using GoBuster with the new feature to discover some PHP Source that leaks the JWT Secret",
        "Using JWT.IO to create our forged JWT and discover a new page that proccesses Video Files",
        "Looking into FFMPEG Vulnerabilities to discover an LFI, using \"Payload All The Things\" to exploit this.  Grab files Apache Config, Config files in web directories, /proc/net to see listening ports",
        "Trying the telegen credentials we retrieved from /var/www/backup/service_config with various services.  See we can login to 6686 but are in a locked down shell"
      ]
    },
    {
      "name": "Player2",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of NMAP",
        "Identifying the Virtual Host (VHOST) player2.htb and doing recon on the webserver",
        "Testing basic SQL Injection on product.player2.htb",
        "Running gobuster against the product domain to find potential pages",
        "Running gobuster to try to enumerate sub domains.",
        "Checking the full port scan of the box to see 8545",
        "Gobuster had an issue enumerating subdomains, switched to wfuzz",
        "Investigation TWIRP because port 8545 had that in an error mesage",
        "Running gobuster to hunt for protobuf files and api endpoints",
        "Exploring the generated.proto file",
        "Seeing how TWIRP uses Protobuf files, then making the HTTP Request to pull credentials"
      ]
    },
    {
      "name": "Poison",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of recon, use Bootstrap XSL Script to make nmap pretty",
        "Looking at nmap in web browser",
        "Navigating to the web page, and testing all the pages.",
        "Testing for LFI",
        "Using PHP  Filters to view the contents of php file through LFI (Local File Inclusion)",
        "Testing for RFI (Remote File Inclusion) [not vuln]",
        "Code Execution via LFI + phpinfo()",
        "Modifying the PHP-LFI Script code to get it working",
        "Debugging the script to see why tmp_name couldn't be found",
        "Shell returned!",
        "Looking at pwdbackup.txt and decoding 13 times to get password.",
        "SSH into the box (Do not privesc right away!)"
      ]
    },
    {
      "name": "Pollution",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Checking out the site, discovering an email (collect.htb) and setting up gobuster",
        "Discovering forum.collect.htb which is running MyBB, someone uploaded a Burp history file which contains API Information",
        "Manually examining the BurpSuite Backup File, and discovering it contains full HTTP Requests",
        "Sending a POST Request to /set/role/admin with the secret token",
        "The Admin Page has a separate registration forum, which sends an XML Request. Trying XXE and discovering Blind XXE",
        "Using my Blind XXE Script to make exfiltrating files quicker",
        "Trying to extract the Apache Configuration, getting the developers.collect.htb.conf file and then getting/cracking the htpasswd file",
        "Logging into developers.collect.htb, cannot login, going back to the Blind XXE getting source code and finding Redis Creds",
        "Enumerating Redis, seeing PHP Sessions, and changing our cookie to say we are an admin",
        "Using the PHP Filter Chain to get code execution on this include() which leads to a shell"
      ]
    },
    {
      "name": "Popcorn",
      "os": "",
      "difficulty": "",
      "techniques": [
        "TMUX and Connecting to HTB",
        "Virtual Host Routing Explanation",
        "File Enumeration (Dirb)",
        "Discover of Web App",
        "Starting SQLMap in the Background",
        "Uploading a PHP Shell",
        "Python PTY Reverse Shell (Tab Autocomplete!)",
        "MOTD Root (Method 1)",
        "Dirtyc0w Root (Method 2)",
        "Twitter: @ippSec",
        "Low Priv - File Upload (Torrent image)"
      ]
    },
    {
      "name": "Postman",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Begin of nnmap scan",
        "Checking out the website, trying to identify what technology runs the site",
        "Nmap scan finished, start more recon (GoBuster and full nmap port scan)",
        "Trying to find out when the website was stood up with exiftool",
        "Full nmap showed the REDIS port, initial poking",
        "Searching the internet for things you can do with a REDIS Server",
        "Dropping a webshell didn't work, lets try dropping an SSH Key",
        "Discovering the location of a .ssh directory by guessing the default (/var/lib/redis/.ssh)",
        "Got a shell on the box!",
        "Running LinPEAS",
        "Running LinEnum twice (once with throrough mode enabled).  To make sure we have good recon.",
        "Discovering Matt logged in at a time we did not previously have"
      ]
    },
    {
      "name": "POV",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering the Dev Subdomain",
        "Playing with the Resume Download, discovering a File Disclosure Vulnerability",
        "Discovering some odd behavior with ../, its just a replace.  Grabbing web.config",
        "Using YsoSerial.Net to create a malicious ViewState Gadget, be careful with command prompt and single quotes!",
        "Getting a reverse shell with a web cradle",
        "Shell returned, discovering a Password stored with Secure String, decrypting it",
        "Showing the password, using Invoke-Command to switch users but having trouble getting the SeDebugPriv enabled",
        "Method 1: Using Meterpreter to take advantage of SeDebug by Migrating into another process",
        "Method 2: Showing RunasCS will get us the debug permission but PSGetSys script will fail. Meterpreter does not fail oddly",
        "Method 2.5: Disabling the firewall and showing Evil-WINRM works with PSGetSys, so it is how RunasCS is generating the shell"
      ]
    },
    {
      "name": "Precious",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Checking out the web page and finding command injection in the URL",
        "Space appears to be a bad character with command injection. Normal tricks like brace expansion or IFS don't work.",
        "Trying IFS to be a space but the trailing character makes it difficult",
        "Taking a step back from the RCE, downloading the PDF to examine metadata and discovering it was made with pdfkit 0.8.6, which has public POC's against it",
        "The POC puts a space before the exploit which then removes the space being a bad character in our exploit",
        "Beyond Root/Edit: Using $- to terminate the $IFS, allowing us to bypass the need to prepend the space",
        "End of edit, shell as ruby, discovering credentials in a config file for henry",
        "Henry can run sudo, discover he can execute a ruby script",
        "Looking up a ruby deserialization exploit with YAML",
        "Finding a different payload and getting a root shell"
      ]
    },
    {
      "name": "Previous",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Wappalyzer detects NextJS and shows the version, looking at CVE's",
        "Looking at the nextjs middleware vulnerability (CVE-2025-29927)",
        "Our nuclei scan didn't detect it, looking at templates, it should but needs the headless flag",
        "Adding the x-middleware-subrequest to our request to bypass auth",
        "Setting BurpSuite to add a header, so we don't have to manually add the middleware to our request",
        "Discovering a File Disclosure in the examples",
        "Building a skeleton project to find configs, grabbing package.json then using npm build",
        "Finding credentials in the nextauth, getting credentials and then logging in with SSH",
        "We can run a specific terraform command with sudo, env_reset is not enabled but we can't edit path",
        "Declaring source_file in our environment, which then will use it in the script. Using SymLink to read unintended files"
      ]
    },
    {
      "name": "Previse",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of nmap",
        "Running GoBuster, discovering the redirects have filesizes",
        "Showing the Execute After Read vulnerability (EAR) by using BurpSuite to hit / and discovering the page",
        "Using grep to show us only what we want (oP)",
        "Using BurpSuite to intercept the response to the request so we can disable the redirect (EAR). Then using the webform to create an account (IDOR)",
        "Examining the website source, using grep to look for places with user input",
        "Testing the logs.php page for shell injection, then getting a reverse shell",
        "Going into the webconfig to get database creds, then dump and crack creds",
        "Testing local users with the passwords from the database to get m4lwhere's creds",
        "Checking sudo to see something is weird, the env_reset/secure_path is not there. (this is configured in /etc/sudoers)",
        "Explaining Path Injection, then taking advantage of a script in sudo not using absolute paths"
      ]
    },
    {
      "name": "Proper",
      "os": "Windows",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap and checking the website",
        "Looking at the web console which shows the page making a request to Products-Ajax.php then playing with the parameters",
        "If the hash parameter is missing the application errors and leaks the secret key and identifying how it signs",
        "Using SQLMaps Eval parameter to automate the secure hash generation (Calculated Parameter Bypass)",
        "Logging into the application with a password from the database and discovering a LFI",
        "Creating a python script to automate the LFI Exploitation",
        "Script done attempting to perform RFI",
        "Another Stack Trace, identifying a race condition in their check for examining malicious php files",
        "Using SMB to steal the hash of the user running the webserver",
        "Exploiting the race condition with inotify to get the server in order to execute our PHP Code",
        "Reverse shell returned!  Finding the GoLang Program"
      ]
    },
    {
      "name": "Puppy",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "NFS is listening on Windows which is odd, looking into it briefly and not finding anything",
        "Using NXC to list shares and running RustHound",
        "Adding ourself to developers, which will let us access the develoeprs share",
        "Cracking a newer Keepass database (hash alg 4000). Currently not supported in Hashcat, need to use a new version of John",
        "Copying credentials out of keepass and doing a password spray to gain access to Ant.Edwards",
        "Looking at what Ant can do with Bloodhound, discovering we have GenericAll to Adam.Silver, using BloodyAD to change his password",
        "Still can't login to Adam since he is disabled, using BloodyAD to re-enable the account and accessing the box via WinRM",
        "Finding a backup. Looking into it to discover another set of credentials",
        "Running WinPEAS, finding DPAPI Data",
        "Downloading the DPAPI Master Key and Credential Blobs, to download with EvilWINRM need to remove the hidden attribute"
      ]
    },
    {
      "name": "Querier",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Begin of Reocn",
        "Using SMBMap to enumerate fileshares",
        "Discovering an Excel Macro File",
        "Using olevba to extract macro from the document to discover credentials",
        "Using MSSQLClient.py from Impacket to log into the SQL Server",
        "Doing the SQL CMD:XP_DIRTREE to read a file off a UNC Share to steal the hash with Responder",
        "Cracking the NetNTLMv2 Hash",
        "Explaining the Responder Database file to view previously captured hashes",
        "Logging into the SQL Server with the cracked account, then doing XP_CMDSHELL to run commands",
        "Getting a Nishang Reverse Shell",
        "Running PowerUp, doing Invoke-ServiceAbuse and discovering creds in an old Group Policy Object",
        "** For some reason the user created with Invoke-ServiceAbuse cannot write to C$ so no psexec :("
      ]
    },
    {
      "name": "Quick",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Begin of Nmap, examining the page and running gobuster",
        "Identifying some extra care",
        "Adding portal.quick.htb to the host file so we can resolve hostname",
        "Trying to identify if the web application will tell us if an account is valid",
        "Building an email list based upon clients and then running wfuzz to try and identify valid emails",
        "Searching for the latest HTTP and seeing HTTP3 utilizes UDP instead of TCP",
        "Installing Quiche so we can navigate to the http3 site",
        "Having Quiche download files, discoving an initial password then revisiting the bruteforce to gain access to a ticket system",
        "Using wfuzz to search the helpdesk for all tickets",
        "Finding ESIGATE is vulnerable to xml entity injection",
        "Testing the XXE Attack to see if it connects to our webserver"
      ]
    },
    {
      "name": "Rabbit",
      "os": "Windows",
      "difficulty": "Insane",
      "techniques": [
        "Begin of Recon (nmap, setting hostname, dns, nmap, ipv6)",
        "Checking websites (80,443,8080)",
        "Attempting to enumerate users of OWA-2010 (Fails)",
        "Checking out Joomla Version (/administrator/manifets/files/joomla.xml)",
        "Using SearchSploit with (Complain Management System)",
        "Register Account, Login, Verify/Play with SQL Union Injection",
        "Enumerating SQL Injection with SQLMap",
        "Going back to MSF/OWA_LOGIN and testing credentials.",
        "Logging into OWA and reading email to find out OpenOFfice, Defender, and Powershell Constain Mode is installed",
        "Creating a malicious OpenOffice macro with LibreOffice + Downloading an Executing a file without Powershell (certutil ftw)",
        "Compiling Merlin (like MSF/Empire)",
        "Sending the email and waiting."
      ]
    },
    {
      "name": "RainyDay",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Identifying this page is built with flask based upon a 404 page",
        "Looking at /api/",
        "Showing a weird bug in python where you cannot run int() on a string that is a float",
        "Showing the source code on why this bypassed the check",
        "End of edit, extracting all the users passwords with curl",
        "Cracking the hashes and getting a password of rubberducky, playing with creating containers",
        "Getting a reverse shell on the Alpine-Python container",
        "We are a privileged container and can see processes from root, which lets us access the hosts disk and CWD leaks file handles to directories. Grab an SSH Key",
        "Can execute safe_python with sudo as jack_adm but it turns out to be a sandbox, eventually find a use-after-free vuln on google and use that to escape",
        "Shell as Jack_adm, we can use sudo with hash_password.py, its a bcrypt hash but we can't crack what we create"
      ]
    },
    {
      "name": "RE",
      "os": "Windows",
      "difficulty": "Hard",
      "techniques": [
        "Begin of Recon",
        "Creating an entry in /etc/hosts for reblog.htb (found on webpage)",
        "Reading each blog post and taking notes",
        "Poking at SMB to see MALWARE_DROPBOX",
        "Digging into why SMBMAP says READ_ONLY.  Don't get anywhere but its an impacket thing?",
        "Installing LibreOffice, then creating a macro to ping us",
        "Obfuscating the macro by placing it over multiple lines (do LOLBINS at end of video)",
        "Converting our obfuscated macro to a powershell cradle/one lienr (iconv to make it UTF-16LE)",
        "Reverse Shell returned as LUKE, showing a way to get a logged in users hash and attempting to crack",
        "Running WinPEAS.bat (will do EXE at the end of the video)",
        "Going over the process_sample.ps1 script to discover a potential WinRAR Vulnerability",
        "Using evilWinRAR to generate a ZipSlip like file, forget a trailing slash and do quite a bit of troubleshooting"
      ]
    },
    {
      "name": "Ready",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap discovering gitlab",
        "Registering for an account, then finding the version",
        "Searching the GitLab commit history to see the patch changing how localhost is verified",
        "Using the import repo from URL feature to force the server to make a request",
        "Attempting SSRF Attacks with Gopher",
        "Successfully got the server to connect back using git with line breaks",
        "Finding a gitlab RCE Path from SSRF using Redis",
        "Failing to gttempting to get RCE",
        "Ping isn't working, trying Whoami with NC",
        "Finally get RCE with whoami and putting a space at the end of our payload",
        "Attempting to get a Reverse Shell"
      ]
    },
    {
      "name": "Rebound",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap then checking SMB Shares",
        "Using NetExec to do a RID Brute Force and increase the maximum to 10000",
        "Using vim g!/{string}/d to delete all lines that do not contain something to build wordlists",
        "Using ASREP Roasting to perform a Kerberoast attack without authentication",
        "Using NetExec to run Bloodhound as ldap_monitor",
        "Discovering Oorend can add themself to the ServiceMgmt group, which can take over the WinRM Account",
        "Spraying the password of the ldap_monitor account to discover it shares oorend's password",
        "Showing BloodyAD to add Oorend to ServiceMGMT then abusing the GenericAll to Service Users, so we can reset WinRM_SVC's password",
        "Showing a more opsec friendly way to take over WINRM_SVC by abusing shadow credentials so we don't change the accounts password",
        "As WINRM_SVC we cannot run some commands like qwinsta or tasklist. Using RunasCS, to switch our login to a non-remote login which will let us run these commands",
        "Performing a Cross Session attack with Remote Potato to steal the NTLMv2 Hash of another user logged into the same box we are"
      ]
    },
    {
      "name": "Redcross",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Flow chart of potential paths through this box",
        "Begin of recon, SSL Enumeration, examining PHP Behavior",
        "Using GoBuster to dicover directories, pdf's, and php scripts",
        "Using wfuzz to discover subdomains (virtual host routing)",
        "Guessing credential, logging in with guest:guest disover SQL Injection",
        "Manually doing an error-based SQL Injection with extractquery()",
        "** Go watch the Enterprise Video if you want Double Query Based Errors **",
        "A good screenshot showing the SQL Inject Queries used, then cracking",
        "Doing the SQLInjection with SQLMap, needed the delay flag!",
        "** Going back to start of box",
        "Examining the account-signup.pdf to create a user",
        "Doing XSS (cross site scripting) to steal a cookie of  the admin"
      ]
    },
    {
      "name": "Reddish",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Begin of Recon (Port Scans)",
        "Reverse Image Searching an favicon to get application used",
        "NODE-RED: Reverse Shell Returned",
        "NODE-RED: Running IP and Port Scans to identify lateral movement targets",
        "Downloading Chisel (Go Program for Tunnels).",
        "Shrinking Go Programs by using ldflags and upx packing from 10Mb to 3Mb!",
        "PowerPoint: Explaining Reverse Pivot Tunnel using Chisel",
        "WWW: Tunnel online, examining the website",
        "Full Port Scan to 172.19.0.2, discover REDIS",
        "Searching for ways to execute code against REDIS",
        "Using REDIS to create a PHP Shell",
        "PowerPoint: Explaining Local Pivot Tunnel using Chisel"
      ]
    },
    {
      "name": "RedPanda",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Poking at the web page, examining the request, playing with server headers",
        "Discovering an error message, googling it and finding out it is tied to Sping Boot",
        "Start of FFuf, using a raw request so we can ffuf like we can sqlmap",
        "Going over the results of FFUF",
        "Matching all error codes with FFUF which is very important, going over the special characters",
        "The curly braces return 500 in FFUF, big indication it is going to be SSTI",
        "Using HackTricks to get a Spring Framework SSTI payload and getting command execution",
        "Using curl to download a shell script and then execute it because we are having troubles getting a reverse shell",
        "Going back to just show the Match Regex feature of FFUF to search for banned characters",
        "Searching the file system for files owned by logs, discovering redpanda.log.  Using a recursive grep to find out what uses this"
      ]
    },
    {
      "name": "Reel",
      "os": "Windows",
      "difficulty": "Hard",
      "techniques": [
        "Begin of Nmap",
        "Examining the anonymous FTP Directory and discovering email addresses in Meta Data",
        "Manually enumerating valid email addresses via SMTP",
        "Creating a \"Canary Document\" in Word to ping back to our server when a word document is opened",
        "Generating a malicious RTF Document (CVE-2017-0199)",
        "Shell Returned.  Enumerating the AppLocker Policy",
        "Decrypting a PowerShell Secure String to reveal Tom's Password, Testing access with SSH",
        "Lets forget we had Tom and run Bloodhound from Nico!",
        "First time opening BloodHound on this box.",
        "Lets update Bloodhound, looks like some data is missing and there were errors when running it",
        "Finding a path from Nico to BACKUP_ADMINS and explaining Active Directory (AD) Security Objects (GenericWrite, WriteOwner,etc)",
        "Taking Ownership over Herman then allowing Nico to change his password and examining bloodhound"
      ]
    },
    {
      "name": "Reel2",
      "os": "Windows",
      "difficulty": "Hard",
      "techniques": [
        "Start of NMAP",
        "Gobuster using a case insensitive wordlist because windows",
        "Checking out the application on port 8080, wallstant",
        "OWA Discovering the Exchange version based upon login interface",
        "OWA How the \"User Enumeration\" of Exchange may work... It's time based",
        "Troubleshooting the Metasploit Module, SSL Error prevents it from loading ECONNRESET SSL_CONNECT",
        "Using Wallstant to build a username list to perform password spray",
        "Using Username Anarchy to take our list of names and build a wordlist of usernames",
        "For some reason when using Metasploit's OWA Password Spray, OWA_2010 is broken... but settiing it to OWA_2013 works.",
        "Showing SprayingToolkit to bruteforce OWA without metasploit",
        "Sending an email address to all users and seeing if anyone clicks the link"
      ]
    },
    {
      "name": "Registry",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Begin of Recon, discovering hostname in SSL Certificate",
        "Running GoBuster against Registry.htb and Docker.Registry.htb to discover CA Certificate in /install/",
        "/v2/ on Docker.Registry.HTB requires login, guessing admin:admin and then looking into the Docker Registry API",
        "Manually downloading a Blob off the Registry and extracting it to reveal files",
        "A bit more elegant way to do this, configure Docker to use this registry by adding the CA to our Docker SSL Cert Store.  Then downloading the Bolt-Image Container",
        "Discovering an Encrypted SSH Key on the container",
        "Explaining SSH Config Files",
        "Using find to show files modified between two dates to discover a file with the SSH Key Password",
        "Using more forensic artifacts (viminfo) to dicover the file with SSH Key Password",
        "Checking /var/www/html to discover the Web User can probably use sudo with restic.  Try to get a shell as www-data",
        "Checking out Bolt CMS Exploits to discover an authenticated RCE",
        "Downloading the bolt SQLite database then viewing the contents and cracking the admin password"
      ]
    },
    {
      "name": "Remote",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Begin of nmap, enumerate ftp, and smb",
        "Taking a look at the website to discover umbraco",
        "Examining NFS with showmount",
        "Discovering umbraco.sdf on NFS is a database and contains the admin password",
        "Logging into umbraco and discovering the unauthenticated RCE",
        "Editing the umbraco exploit to ping our box",
        "Getting a reverse shell using Invoke-WebRequest instead of (New-Object Net.WebClient)",
        "Running WinPEAS to discover UsoSvc service is editable",
        "Editing the UsoSvc binpath to execute our reverse shell",
        "Alternate Path: Using Rogue Potato to get a shell"
      ]
    },
    {
      "name": "Resolute",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Talking about my switch to Parrot",
        "Begin of nmap, discovering it is likely a Windows Domain Controller",
        "Checking if there are any open file shares",
        "Using RPCClient to enumerate domain users (enumdomusers)",
        "Using CrackMapExec to dump the PasswordPolicy",
        "Using RPCClient to dump Active Directory information (querydispinfo)",
        "Bruteforcing accounts via CrackMapExec with password of Welcome123!",
        "Using Evil-WinRM to remote into the server as Melanie",
        "Building the latest version of Seatbelt on CommandoVM (The DotNet version is incompatible)",
        "Explaining some cool bash one line tricks, then linking Egypt's \"One liners to rule them all\" talk",
        "Changing Seatbelt to compile to Version 4.0 then trying again."
      ]
    },
    {
      "name": "Resource",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering LFI in the page parameter but we cannot immediately exploit it",
        "Discovering admin and playing with ping, deciding its not vulnerable and moving on",
        "Uploading a zip file to the ticket, then using the phar wrapper with our LFI to include it",
        "Shell returned on the box, python doesn't exist using script to fix our tty",
        "Editing our session file on the box, so we can change users without having to change the database",
        "Obtaining the HAR File from a ticket, showing Google's web app that visualizes the file",
        "Examining the HAR File from command line, which I think is easier",
        "Discovering old SSH CA Files in msainristil's directory, checking the SSH Config to see it has TrustedUserCaKeys which lets this CA Sign Public Keys",
        "Using SSH-Keygen to sign a public key with a CA specifying root as the principal then logging in",
        "Discovering a bash script which uses a web API to sign certificates with another CA, creating a ticket that lets us on as support"
      ]
    },
    {
      "name": "Response",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Start of nmap",
        "Discovering the /status/ page which gives us some information on how to use the Proxy",
        "Start of coding our own proxy",
        "Downloading the source code to the chat application",
        "Modifying our proxy to forward all requests to chat.reponse.htb and adding a webserver to it",
        "Web Proxy is up! But we need to replace some URL's to send everything through our proxy",
        "Adding POST Request support",
        "Post request working!  Can login with Guest and talk to Bob over the chat",
        "Discovering the login request also sends a LDAP Server, we can point the login request to a ldap we control",
        "Using ChatGPT to Give us the hex to a successful LDAP Bind, so we can login after poisoning the LDAP Server",
        "Logged in with admin!"
      ]
    },
    {
      "name": "Retired",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Talking about what the page parameter does and why its normally vulnerable to LFI",
        "Running gobuster to get a list of files on the webserver while we poke at the LFI",
        "Finding an LFI in combination with an EAR (Execute After Read) Vulnerability. Then examining the source code of index.php to see the vulnerability",
        "There was an sanitize string function that wasn't recursive, explaining how we could exploit this.",
        "Discovering beta.html which is a license upload, grabbing the source code and vulnerable application",
        "Grabbing netstat like information, running processes, and memory maps with our LFI Vulnerability",
        "Playing with the activate_license executable and finding a buffer overflow",
        "Using GDB to examine the crash, need to use set follow-fork-mode child to follow the fork",
        "Crashing the program with a pattern and finding the offset to RSP",
        "Start of creating our exploit script"
      ]
    },
    {
      "name": "Rope",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Nmap the box, then play with the WebServer. 404 msg are interesting",
        "Discovering Directory Traversal and then grabbing the webserver by going to /proc/self/cwd/",
        "Opening the binary up in Ghidra and exploring the binary to understand what it does",
        "Discovering we have control over the first argument in log_access/printf",
        "Showing one of my most hated things about debugging forks.  Be sure to always kill the process!",
        "Using GDB to help us analyze the log_access call, by breaking and examining the stack",
        "Begin of PrintF (Format Strings) Exploitation, leak a bunch of memory addresses, then identify a spot in memory where we control",
        "Starting to write an exploit script",
        "Grabbing /proc/self/maps to obtain a memory map which helps bypass ASLR.  Analyze the binary again and see it supports the \"RANGE\" HTTP Header which is required to grab these special files",
        "Back to Coding the exploit script, now that we can grab the process map",
        "Testing our leaking/rebasing code to verify we are leaking correctly then using fmtstr_payload to automate the exploit"
      ]
    },
    {
      "name": "Rope2",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Start of nmap",
        "Checking out the webpages, find Gitlab and Page about a custom chrome",
        "Viewing the Git log for the custom v8 javascript project and finding the vulnerability",
        "Finding an XSS in Contact Us",
        "Using the banners to find what version of Ubuntu the target is using",
        "Building v8 in Ubuntu 18.04",
        "Warning about needing 4 gigs of memory.",
        "Everything is compiled!  Start of the exploit, looking at some webpages that help out",
        "Starting v8 in gdb, then examining some memory structures",
        "Explaining Smi, Immediate Small Integer",
        "Starting our helper script with number conversions (float/bigint/hex)"
      ]
    },
    {
      "name": "RouterSpace",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Downloading the APK",
        "Running apktool to decode the APK, examining files, don't get much info",
        "Finding a certificate in the application that gives up the host name",
        "Trying out another APK Decompiler, Bytecode Viewer",
        "Start of setting up Genymotion",
        "Setting up the phone, accidentally choosing an ancient version which won't work",
        "Dragging the app to install it to the phone, get an error have to manually look at log file",
        "Setting up a newer phone so we can install the apk",
        "Installing the APK",
        "Configuring our phone to go through BurpSuite"
      ]
    },
    {
      "name": "Runner",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of NMAP",
        "Discovering the TeamCity Subdomain, which has a version banner showing it running 129390 and is vulnerable to CVE-2023-42793",
        "Exploring the TeamCity Authentication Bypass vulnerability to see why URL's ending in RPC2 don't require authentication",
        "Logged in as an administrator on TeamCity creating a Backup, which has a Database Backup and any SSH Keys associated with projects",
        "Analyzing the SSH Key to discover the username that generated it and logging into the box",
        "Going another route on TeamCity, Enabling Debug Mode than running commands",
        "Showing how to get RCE on Linux when you can specify a Binary with only 1 parameter (Using AWK)",
        "Shell on the box as John, doing basic enumeration",
        "Logged into Portainer as Matthew (cracked password from database dump)",
        "Exploiting RUNC by setting the working directory of a container to /proc/self/fd/8, then gaining access to the root filesystem"
      ]
    },
    {
      "name": "RustyKey",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Syncing our time with the DC via NTPDate",
        "Writing a custom Cypher Query in Bloodhound to show everything that users and computers can directly do, except for group memberships. Discover an oddity around IT-COMPUTER3 and seeing its password se",
        "Using NetExec to perform a TimeRoast attack and then cracking the computer password",
        "Back in Bloodhound, we can see IT-Computer3 has a path to take over several users",
        "Using BloodyAD to add ourself to the helpdesk group and then reset BB.MORGAN's password",
        "Still cannot log in, discovering BB.MORGAN is a member of the Protected Users/Objects group. Trying to use AES instead of RC4 with impacket, still have issue. Assume the domain doesn't support it, thi",
        "Using BloodyAD to remove the user from the Protected Objects group, the logging in with BB.MORGAN",
        "Find a PDF and it talks about Context Menus and COM Objects with Zip programs",
        "Using Req Query to show CLSID's then identifying support can modify the one that points to 7-zip's dll",
        "Using RunAsCS to switch to the support user (ee.reed) as remote logins appeared to be disabled for them"
      ]
    },
    {
      "name": "Safe",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Begin of nmap",
        "Discovering MyApp in the HTML Source",
        "Examining MyApp on port 1337",
        "Opening myapp up in Ghidra",
        "Testing out the buffer overflow",
        "Using pattern search to see where we can overwrite RSP",
        "Create a PwnTool Skeleton and having it call main instead of crashing",
        "Testing calling main (error: need to do recvline to send text)",
        "Explaining hijacking the SYSTEM() call",
        "Finding a way to put user input into RDI",
        "Examining the Test Function which places RSP to RDI",
        "Finding a pop r13 as the Test Function jumps to r13"
      ]
    },
    {
      "name": "Sandworm",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Finding their public key, then sending an encrypted message that contains a XSS Test payload",
        "Creating a PGP Key and sending our public key, so they can send an encrypted message back",
        "Decrypting the message they sent to us",
        "Signing a message, but not encrypting it for them to verify and see they give us the metadata back",
        "Testing a SSTI Payload in the username of the key, and seeing it will dump the config",
        "Finding a SSTI Payload with Jinja2 that gives code execution... First attempt fails",
        "Testing a different SSTI Payload and getting code execution",
        "Reverse shell returned, discovering we are in a jail, attempting to get chisel up and running and failing",
        "Finding admin.json which contains another credential and we can use this to SSH into the box",
        "Logging into MySQL and attempting to crack the hashes"
      ]
    },
    {
      "name": "Sau",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Examining the website, playing with the basket, trying SSTI/SQL Injection special characters",
        "Looking at the settings, discovering we can perform a SSRF and get the response back. Grabbing localhost:80",
        "The local website runs maltrail 0.53, examining the exploit then manually exploiting it to get a shell",
        "Shell returned, checking if we really needed to encode the payload",
        "When systemctl runs status, it sends us to less which we can escape out of and run as root"
      ]
    },
    {
      "name": "Sauna",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Running Nmap",
        "Poking at SMB with CrackMapExec, SMBMap, and RPCClient to get nothing",
        "Checking out the web page",
        "Playing with user input in the website and getting an error \"HTTP VERB used is not allowed\"",
        "Copying names from the website",
        "Using some VIM/VI Magic (macro) to convert names into potential usernames",
        "Identifying valid usernames by using KerBrute which can enumerate valid usernames",
        "Running some Impacket scripts and performing an ASREP Roast to extract password hash from Active Directory",
        "Running GetNPUsers to get the hash for a user and then using hashcat to crack ASREP$23",
        "Seeing a RICOH printer share, pulling EXIF data off website to get an idea if it may be exploitable",
        "Using Evil-WinRM to log into the box with FSMITH and run WinPEAS to get saved credentials"
      ]
    },
    {
      "name": "Scanned - Escaping and Exploiting Chroot Based Jails via Unprotected File Descriptor",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Start of nmap",
        "Using MSFVenom to upload a reverse shell to identify what the malware sandbox looks like",
        "Examining the source code of the sandbox",
        "Creating a program in C to see the size of an unsigned long",
        "Creating a program to replace the output of the trace program and exfil data via the return register on the webapp",
        "Creating a python program to automate uploading the file and returning the output",
        "Creating a program in C to perform ls, so we can enumerate the jail",
        "Changing our ls to enumerate /proc",
        "Adding a readlink() call to our ls program so we can view symlinks",
        "Discovering an open file descriptor in PID 1, using this to escape the jail and read /etc/passwd",
        "Dumping the Django Database"
      ]
    },
    {
      "name": "Scavenger",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Begin of Recon",
        "Discovering an SQL Injection inside of the WhoIs Service",
        "Identifying we can perform DNS Zone Transfers with dig axfr (aquatone is the application i mention to take screenshots)",
        "Explaining the SQL Union Injection",
        "Dumping information out of Information_Schema via the SQL Union Injection",
        "Dumping hostnames out of the whois database via the SQL Union Injection",
        "Discovering the pwned website, discovering shell.php with GoBuster",
        "Using wget to get the date the webserver was defaced",
        "Using wfuzz to find the parameter (hidden) the attackers shell used, then we have code execution on the machine.",
        "Using find with newermt to identify what happened around the time the attacker pwned the box",
        "Discovering mail file that has some credentials for an FTP User",
        "Using grep/awk to find the hacker in an apache access logs"
      ]
    },
    {
      "name": "Scepter",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Looking at the NFS Mount on Windows, then downloading the certificates",
        "Examining the certificates, dumping information to look at username and expiration. Then cracking PEM and PFX",
        "Using certipy to auth with the certificate, discovering some accounts are locked out",
        "Building a PFX File from the key and pem, then logging in and running RustHound with Kerberos since we only have NTLM Hash",
        "Looking at Bloodhound Data and seeing D.Baker can reset A.Carter's password who can take over D.Baker",
        "Running Certipy to look at certificates as D.Baker",
        "Examining LDAP to discover H.Brown has an Alternate Security Identity set",
        "Performing ESC14 by exploiting a chain to give ourself GenericAll then setting our email to H.Browns so we can impersonate h.brown",
        "Using WinRM with Kerberos to login as h.brown",
        "Using BloodyAD to show writable objects as h.brown to see they can write something to p.adams"
      ]
    },
    {
      "name": "Schooled",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Intro FreeBSD Box",
        "Start of nmap explaining why versions are useful",
        "Discovering hostname on the box, then adding it to our host file",
        "Using GoBuster to bruteforce virtual hosts and discovering moodle",
        "Searching Moodle on github to find a way to identify Moodle Version",
        "Reading the Moodle Security Announcements since the Moodle Version",
        "Enrolling in the Math Course the announcement hints at XSS",
        "Testing for XSS in our Moodle Net Profile",
        "Changing our HTML to load an external script and then stealing cookies via document.write",
        "Performing CVE-2020-14321 to escalate from Teacher to Manager in moodle",
        "Enabling plugin installation, then uploading a malicious moodle plugin",
        "Reverse shell returned"
      ]
    },
    {
      "name": "Scrambled",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Viewing the website and discovering NTLM is disabled",
        "Using Kerbrute to enumerate valid users and then password spray with username",
        "Bad analogy comparing Kerberos works with TGT/TGS and Movie Theater Tickets",
        "Using Impacket's GetTGT Script to get Ticket Granting Ticket as Ksimpson and exporting KRB5CCNAME so Impacket uses it",
        "Using GetUserSPN to Kerberoast the DC with Kerberos Authentication and cracking to get SqlSVC's Password",
        "Both credentials we have cannot access MSSQL",
        "Creating a silver ticket to gain access to SQL",
        "Using GetPAC to get a Domain SID",
        "Showing getting Domain SID with LDAPSearch",
        "Creating the Silver Ticket with Impacket's Ticketer"
      ]
    },
    {
      "name": "ScriptKiddie",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Running nmap",
        "Using Firefox Developer Tools to inspect the page and see its a Python webserver",
        "Fuzzing parameters with ffuf to see if anything sticks out",
        "Ffuf isnt giving expected output, lets send the request to BurpSuite to find out we are missing a HTTP Header",
        "Adding the Content-Type header to ffuf and finally fuzzing special characters",
        "There is a MSFVenom CVE and it looks like the webpage uses MSFVenom",
        "Editing the MSFVenom exploit to place a reverse shell but the exploit keeps failing",
        "Using curl to test the RCE",
        "Validated we have RCE, building out a web cradle with our curl to execute code",
        "Reverse shell returned as kid user",
        "Looking at the web application and discovering a logs directory"
      ]
    },
    {
      "name": "Sea",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Trying to identify what is running the webapp (WonderCMS), discovering a themes directory in source and burpsuite",
        "Taking a string that looks unique in the CSS and searching GitHub to discover where it exists in an open-source repo",
        "Showing several ways we could of dirbusted the themes directory to discover this file",
        "Discovering a public POC for the XSS Attack",
        "Showing the pathname is not being set correctly in the public poc, fixing it then getting a callback",
        "We see the webserver downloaded our shell but the poc didn't send it to us directly, manually triggering the callback",
        "Extracting the WonderCMS Password and cracking it",
        "Discovering a few ports listening on localhost, checking /etc to try and figure out the service listening on 8080",
        "Forwarding port 8080 back to our box, then discovering a webapp that has a command injection flaw",
        "Discovering our shell dies quickly, adding a nohup to our reverse shell to make it more stable"
      ]
    },
    {
      "name": "Seal",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Begin of nmap",
        "Browsing to the website and doing some light fuzzing",
        "Adding the uri_hex (url encoder) to our wfuzz to fuzz special characters",
        "Taking a look at port 8080, discovering gitbucket and registering an account",
        "Exploring the infra repository on gitbucket, going over its Ansible Scripts",
        "Taking a look at the Seal Market Repository and discovering NGINX has mutal auth configured",
        "Discovering tomcat credentials in a previous commit",
        "Going over an Orange Tsai SSRF Talk from 2018, showing the Tomcat SSRF when behind NGINX",
        "Testing the SSRF Exploit to discover we can hit protected pages",
        "Logging into tomcat, then showing another SSRF",
        "Using MSFVenom to generate a malicious war file to exploit tomcat"
      ]
    },
    {
      "name": "Search",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Using Kerbrute to identify valid users",
        "Finding credentials for Hope.Sharp in an image on the website",
        "Showing Kerbrute paswordspray silently fails when time is out of sync",
        "Having troubles running the Python Bloodhound Ingestor, a digestmod error",
        "Giving up fixing my environment, creating a python virtual environment to run this script",
        "Uploading data to bloodhound, discovering a kerberoastable (web_svc) account, running GetUserSPN and Cracking the hash",
        "Parsing the raw Bloodhound Data with JQ and dumping all the valid usernames",
        "Using JQ select to show only the users that are enabled, its sql like syntax",
        "Running a password spray with kerbrute to find edgar.jacobs has the same credentials as Web_SVC",
        "Using CrackMapExec (CME) with the spider_plus module to dump all file names, then using JQ to parse the results with map_values(keys)"
      ]
    },
    {
      "name": "SecNotes",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Begin of recon",
        "Checking out the website",
        "Using wfuzz to enumerate usernames",
        "Logging in with an account we created",
        "Checking out Change Password and noticing it does this poorly",
        "Using the contact form, to see if tyler will follow links",
        "Changing Tyler's password by sending him to the ChangePassword Page",
        "Logged in and find SMB Share with credentials.",
        "Found a webshare but not sure the directory it executes from. Begin hunting for a different webserver.",
        "Port 8808 found via nmap'ing all ports.  Creating a php script to gain code execution",
        "Downloading netcat for windows to use as a Reverse Shell",
        "Playing with Bash on Windows"
      ]
    },
    {
      "name": "Secret",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of nmap talking about seeing two ports having the same HTTP Banner",
        "Checking out the webpage to discover source code and some docs",
        "Always RTFM, Playing with the API to Register a user, login, and check out privilege level.",
        "Renaming our burp repeater tab by just double clicking on the number",
        "Trying to login with a name instead of email",
        "Testing our login token to find out it uses JWT's in a non-standard way",
        "Analyzing the source code to see the token is used in a header called \"auth-token\"",
        "Looking at git commit history to see there is a hard coded secret in an older commit and forging a token",
        "Changing our tokens user, going back to the source code and seeing \"theadmin\" is a hardcoded administrative user",
        "Talking about the importance of rotating secrets in a web application",
        "Analyzing the private.js which shows a logs endpoint that is vulnerable to RCE"
      ]
    },
    {
      "name": "Sekhmet",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Running ffuf to discover the portal virtual host",
        "Logging in with admin:admin and discovering a new cookie",
        "Looking at the Node-Serialize exploit",
        "Attempting to do the exploit and discovering modsecurity blocks us, then putting some unicode in the payload to evade it",
        "Whoops forgot to end the payload with (), so thats why we didn't get our shell",
        "EDIT Looking at how modsecurity is configured",
        "Showing the NGINX Error Log with modsecurity blocking, taking the unique ID going to the modsecurity log to get more information",
        "Looking at the JSDECODE transform for modsecurity to fix the rule",
        "Switching ModSecurity to Detection Only mode or Permissive so we don't block but get logs",
        "END OF EDIT, putting an SSH Key on the box"
      ]
    },
    {
      "name": "Sense",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Star of Recon",
        "Getting banned and Pivoting to verify",
        "Logging into PFSense",
        "Manually Exploiting PFsense",
        "Using Metasploit to exploit",
        "Creating a Bruteforce Script in Python ( CSRF )"
      ]
    },
    {
      "name": "ServMon",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Start of NMAP",
        "Using SMBClient to search for open shares (None)",
        "Checking out the web page, some light fuzzing on login and examining how the language selection works",
        "Taking a Screenshot on Parrot and pasting it into Cherry Tree (Shift+PrintScreen)",
        "Checking out FTP and downloading the two txt files",
        "Viewing port 8443, and realizing this page really hates firefox.  Switch to Chromium",
        "Using searchsploit to find there's a directory traversal exploit in NVMS",
        "Grabbing Passwords.txt off Nathan's Desktop (filename was an FTP Note)",
        "Using CrackMapExec to bruteforce logins for SMB and SSH (SSH alread bug fixed in DEV Branch)",
        "Logging in with SSH, then looking for WebServer directories",
        "Examining the NSClient directory to view the config"
      ]
    },
    {
      "name": "Seventeen",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Taking a look at the website",
        "Showing some differences between Ffuf and Wfuzz",
        "Finding a known exploit against the Exam Reviewer Management System",
        "Explaining the boolean injection then running SQLMap",
        "Using SQLMap to extract databases, tables, and some data",
        "Discovering the OldManagement site, dumping its database then logging in",
        "Exploiting the file upload vulnerability in OldManagement by replacing .htaccess",
        "Explaining various ways a developer may handle the file save",
        "Low privilege shell returned, in a docker find credentials in configuration files. Then SSH into the box",
        "Examining port 4873 which is Verdaccio, an NPM Registry. Downloading packages to find hard coded credentials"
      ]
    },
    {
      "name": "Shared",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Taking a look at the website",
        "Searching the PrestaShop github to find a way to fingerprint the website, discovering INSTALL.TXT then finding the commit that contains our version",
        "Discovering checkout.shared.htb",
        "Examining how the checkout subdomain gets the contents of the shipping cart (cookies), editing the cookie and seeing what happens",
        "Testing for SQL Injection within the cookie",
        "Failing to use SQLMap (Debug it at the end of the video)",
        "Doing the Union SQL Injection manually to enumerate Information Schema then dump the users table and get the passwords",
        "Cracking the password for James_Mason and gaining SSH Access",
        "Finding files modified between two dates on linux and discovering some interesting files",
        "Grabbing passwords from the web directory"
      ]
    },
    {
      "name": "Sharp",
      "os": "Windows",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Running CrackMapExec to discover null authentication and an open share",
        "Running Spider_Plus with CME then JQ to parse the output",
        "Looking into KanBan",
        "Using smbclient to download files",
        "Running Impacket's SMBServer so we can easily copy things between our linux and windows VM",
        "Editing the KanBan config to perform a \"password reset\", log into kanban and then decrypt the passwords.",
        "Using DnSpy to decompile KanBan (dotnet) and then extract the Crypto Keys",
        "Creating a python script to decrypt items in the KanBan config",
        "Using CME to password spray with the credentials from KanBan, running spider plus again then downloading files",
        "Using DnSpy yet again to decompile the new executables, discovering dotnet remoting and credentials"
      ]
    },
    {
      "name": "Shibboleth",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Running NMAP",
        "The footer talks about BMC, explaining why I jumped to IPMI when reading this",
        "Running a Virtual Host (VHOST) Scan with Wfuzz to try and find a domain that points to an ILO",
        "Talking about IPMI",
        "Running Metasploit to dump the IPMI Hash and then crack it with hashcat",
        "Running IPMITool to explore the interface, there isn't anything really here",
        "Logging into Zabbix with the credentials and then fumbling around creating a malicious check",
        "Discovering what we were doing wrong, we didn't want to put quotes in the system.run command",
        "Zabbix kills our shell pretty quickly, just running a second command really fast in order to keep a process alive",
        "Attempting to get into the Zabbix database, need to switch to the ipmi-svc user",
        "Showing a cool MySQL command \\G to display results in a table form, useful when dumping a lot of columns"
      ]
    },
    {
      "name": "Shocker",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "If you want some more details about the actual ShellShock exploit, check out the Beep Video.",
        "Begin Nmap, OS Enum via SSH/HTTP Banner",
        "Viewing CGI Script",
        "Begin NMAP Shellshock",
        "Debugging Nmap HTTP Scripts via Burp",
        "Fixing the HTTP Request & nmap script",
        "Performing Shellshock & more fixing",
        "Getting a reverse shell",
        "Running LinEnum.sh",
        "Rooting the box"
      ]
    },
    {
      "name": "Shoppy",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of nmap",
        "Taking a look at the web page",
        "Discovering it is NodeJS based upon the error message [MasterRecon]",
        "Performing NoSQL boolean injection (mongodb) to bypass authentication",
        "Working payload for the NoSQL Injection.",
        "Dumping the user database with more NoSQL Injection and using CrackStation to get the password",
        "Using ffuf to find the mattermost.shoppy.htb subdomain",
        "Logging into MatterMost and getting a credential",
        "Log in as the Jaeger user and use strings to get a hardcoded password from the password-manager binary",
        "SSH into the box as the Deploy User, discover we can run Docker commands and use that to privesc by starting a new container that mounts the root fs",
        "Exploring the Password-Manager binary in Ghidra"
      ]
    },
    {
      "name": "Shrek",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Examining the Web Page",
        "Finding /uploads/ Directory",
        "Finding /secret_area_51/ Directory",
        "Using Audacity to find Steg in Audio",
        "FTP With Creds revealed from Steg",
        "Examining files downloaded from FTP",
        "Finding decryption key + blob",
        "Using Python seccure to decrypt ecc",
        "SSH Into Shrek as SEC",
        "Farquad Rabbit Hole"
      ]
    },
    {
      "name": "Sightless",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering SQLPad",
        "Discovering a SSRF in SQLPad when adding connections. Sending to FFUF, use a time filter to show timeouts",
        "Finding the SQLPad Version (6.10.0), which has a template injection vulnerability getting a shell",
        "Shell returned, extracting the SQLPad database",
        "Cracking the shadow file of the docker container to get michaels password",
        "Shell as Michael, discovering headless chrome is running forwarding ports to access it",
        "Logging into froxlor, getting RCE as root by changing PHP-FPM Configuration",
        "Doing the box the intended way, getting Froxlor Cookie via XSS",
        "Changing the Web1 users password so we can FTP Into the box",
        "Cracking the Keepass database to get root ssh key"
      ]
    },
    {
      "name": "Signed",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Logging into the SQL Database with the provided credentials, going over basic enumeration",
        "Using XP_DIRTREE to have the SQL Server make a request, sending it to ourself and stealing/cracking the hash",
        "Showing RID Brute Forcing with MSSQL to enumerate additional users",
        "Explaining how the SUSER_SID command performs a SID Bruteforce, converting the SID from binary to String notation",
        "Creating a Silver Ticket with Ticketer.py",
        "Impersonating an admin, so we can enable xp_cmdshell to get a shell on the box",
        "Showing CVE-2025-33073 posts, which explains the attack we will do with NTLM Relay and cred marshalling",
        "Getting Chisel up and running so we can add DNS Names",
        "Adding a special DNS Name so we can impersonate DC01, then starting NTLMRelay and forwarding connections to WinRM",
        "Using NetExec's coerce_plus to force a request to be made to our special DNS Name and getting a shell"
      ]
    },
    {
      "name": "Silo",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Begin of recon",
        "Begin of installing SQLPlus and ODAT (Oracle Database Attack Tool)",
        "Bruteforcing the SID with ODAT",
        "Holy crap, this is slow lets also do it with Metasploit",
        "Bruteforcing valid logins with ODAT",
        "Credentials returned, logging into Oracle with SQLPlus as SysDBA",
        "Reading files from disk via Oracle",
        "Writing files to disk from Oracle.  Testing it in WebRoot Directory",
        "File Written, lets write an ASPX WebShell to the Server",
        "WebShell Working!  Lets get a Reverse Shell",
        "Reverse Shell Returned",
        "Finding a DropBox link, but password doesn't display well."
      ]
    },
    {
      "name": "Sink",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Start of nmap, finding version of gunicorn is from 2019",
        "Enumerating the Gitea version (the 404 error page shows it)",
        "Trying to find the Gitea version another way (HTTP Files)",
        "Downloading jquery.js, grabbing the md5, then using VirusTotal to get an idea when it was released",
        "Looking at the second website (Running on gunicorn)",
        "Testing for IDOR Vulnerabilities in the /notes/, can confirm a note exists but not read anything",
        "Start of explaining the HTTP Smuggling",
        "Adding non-ascii characters to Burpsuite Requests via Base64 Decoding",
        "Explaining HTTP Chunking",
        "Smuggling request created, re-explaining the attack and importance of Content-Length",
        "Sending the Smuggling request in BurpSuite then getting the cookie of another user"
      ]
    },
    {
      "name": "Sizzle",
      "os": "Windows",
      "difficulty": "Insane",
      "techniques": [
        "Begin of Recon",
        "Checking the web interfaces",
        "Discovering there is a Certificate Authority",
        "Taking a look at LDAP",
        "Examining SMB to find shares",
        "Searching the Operations and Department Shares",
        "Viewing permissions of a SMB Share with SMBCACLS",
        "Discovering a writeable share, dropping a SCF File to get a hash",
        "Using Hashcat to crack NetNTLMv2",
        "Using SMBMap to identify if this user has access to anything extra",
        "Discovering the CertSRV Directory",
        "Discovering Powershell Remoting"
      ]
    },
    {
      "name": "Skyfall",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering the demo subdomain, which is a Flask website",
        "Quickly playing with the File Download, Upload, and Rename -- Looking for low hanging fruit, not finding any",
        "Playing with the URL Fetch looking for a good SSRF, Discovering the site is likely in Docker",
        "Running FFUF with our SSRF to identify ports listening on the Host and Docker",
        "Talking about the two different 403's and why its important that one is coming from Flask and the other NGINX",
        "Talking about a URL Parsing bug between NGINX and PYTHON/WERKZEUG where strip is removing some special characters after NGINX letting us bypass the denylist",
        "Viewing the Metrics Page and getting information about MinIO Discovering it is out of date and exploiting CVE-2023-28432 to get the credentials",
        "Downloading the MinIO Client, then interacting with the filesystem manually",
        "Searching all fileversions on MinIO then finding an older copy of .bashrc which contains an hashicorp vault API Key",
        "Downloading and running the Hashicorp Vault Binary to interact with the service"
      ]
    },
    {
      "name": "Smasher2",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Begin of Recon",
        "Using Wireshark to see why Nmap said HTTP 403",
        "Running GoBuster to identify /backup",
        "Performing a DNZ Zone Transfer with dig axfr",
        "Manually playing with the login form to hunt for SQL Injection",
        "Downloading files out of /backup, opening auth.py with vim and ses.so with ghidra",
        "Examining /auth endpoint",
        "Examining ses.so in Ghidra",
        "Renaming variables from Ghidra's decompiler to try to make sense of the code",
        "Examining get_internal_usr and pwd to discover the bug",
        "Using GDB to debug python and step through ses.so, which makes analyzing decompiled code easier",
        "First time attaching the debugger - Seg faults for some reason."
      ]
    },
    {
      "name": "Sneaky",
      "os": "",
      "difficulty": "",
      "techniques": [
        "If you're wondering how this could be an hour long video, over half the video is talking about IPv6.",
        "Recon + Web Enum",
        "SQL Injection",
        "Start of IPv6 Talk",
        "What is an IPv6 IP Address?",
        "Types of IPv6 Addresses",
        "IPv6 Subnetting Explained",
        "End of IPv6 Primer, Exploit time!",
        "Method 1: Getting MAC and calculating fe80",
        "Method 2: Enumerating Networks by pinging Multicast",
        "Extra: Getting Windows to respond from Multicast Ping"
      ]
    },
    {
      "name": "SneakyMailer",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Poking a the websites",
        "Starting gobusters in the background while we look at the site",
        "Grabbing a list of emails off of the website",
        "Using SWAKS to mass email users with a link",
        "User went to our website, grabbed credentials",
        "Failing to do FTP User Enumeration, do this at the end of the video",
        "Failing with Thunderbird to login",
        "Switching to the Evolution Mail client to check mailboxes, finding FTP Details in Sent Mail",
        "Using wget to mirror the FTP Directory, then poking at PHP Files",
        "Showing pypi/Register.php, which *should* have been used during the phishing stage"
      ]
    },
    {
      "name": "Sniper",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Begin of Nmap scans",
        "Checking out the website and running a few GoBuster dir searches",
        "Examining Links on the blog page and discover a LFI Vulnerability in the LANG Parameter",
        "Discovering .. is a bad character, working around it by starting the path with a slash",
        "Testing RFI via SMB, then failing to steal a hash and use impackets SMBServer",
        "Configuring SMBd to host a share that is accessible by anonymous users",
        "Testing the SMB Share locally, then testing the RFI with just text, and finally putting a PHP Script for code execution.",
        "Powershell Reverse Shells fail, find out we are in constrained language mode, switch to netcat for reverse shell",
        "Reverse Shell Returned!",
        "Discovering Chris's password then using Powershell to run a command as him to upgrade the shell.",
        "Going over to Windows to create a malicious CHM file with Nishang's out-chm (via NC on a SMB Share)",
        "Copying the malicious CHM File to c:\\Docs and not getting any shell.  Simplify the exploit to run ping instead."
      ]
    },
    {
      "name": "Snoopy",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap, discovering ssh/dns/http",
        "Taking a look at the website",
        "Discovering a message about DNS, taking a look at the DNS and discovering zone transfers are enabled",
        "Identifying the website is running with PHP Enabled, then running gobuster",
        "Attacking the file download and discovering File Disclosure",
        "We got lucky discovering the File Disclosure filter bypass, using FFUF which would be make catching this more consistent",
        "Automating the File Disclosure by creating a python script",
        "Looking at files on the target, discovering the DNS Configuration which has the RNDC Key to update DNS",
        "Looking at the NSUPDATE Man page and then adding a the DNS Record mail.snoopy.htb and pointing it to us",
        "Using python to run a SMTP Server and then having Mattermost's forgot password email us the password reset",
        "Using the Mattermost bot to provision a server via SSH which causes it to SSH back to us"
      ]
    },
    {
      "name": "Soccer",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Introduction",
        "Start of nmap, assuming the web app is NodeJS based upon a 404 message",
        "Running Gobuster and discovering Tiny File Manager",
        "Looking for the source code and finding a default password of admin@123",
        "Navigating to uploads and attempting to upload a php shell to the website",
        "Getting a reverse shell with our php shell",
        "Reverse shell returned",
        "Talking about hidepid=2 is set, so we can't see processes for other users",
        "Looking at nginx configuration to see what port 9091 is and discovering a new subdomain (soc-player.soccer.htb)",
        "Navigating to soc-player.soccer.htb and discovering a few more pages",
        "The /check endpoint looks like it is vulnerable to Boolean SQL Injection",
        "Intercepting the websocket in BurpSuite and showing"
      ]
    },
    {
      "name": "Socket",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Taking a look at QReader.htb",
        "Opening the QReader application to discover it requires GLIBC_2.35, going back to nmap to see what flavor of linux was used",
        "Switching to Ubuntu Jammy and running Wireshark with the app running to see it makes a request to WS.QREADER.HTB",
        "Using BurpSuite to intercept this thick client by setting it up as a transparent proxy",
        "Playing with the websocket and discovering SQL Injection",
        "Using WebSocat and watch to build a quick client to test the SQL Injection over websockets and playing with Union to see how many columns are needed",
        "Identifying what database is used, using SQLITE_VERSION() and seeing it is SQLITE. Then dumping the schema of SQLITE",
        "Dumping the Users table",
        "Dumping the other tables, getting the name of the admin in the answers table",
        "Using username-anarchy to generate a bunch of potential usernames, then using CrackMapExec to spray ssh"
      ]
    },
    {
      "name": "SolarLab",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering Guest can read files on SMB, using mount to copy all the files",
        "Grabbing usernames and passwords from the excel document so we can use them for spraying",
        "Taking a look at port 6791 to see ReportHub, using FFUF to spray usernames to get a valid user",
        "Using FFUF to spray two parameters, username and password by giving it two wordlists and settings markers",
        "Discovering the PDF ReportHub generates uses ReportLab which has a known vulnerability",
        "Shell returned on the box as Blake",
        "Copying the SQLite Database ReportHub uses to our box over SQLite so we can dump it",
        "Spraying passwords again from the SQLITE Database, getting OpenFire's password then using RunasCS to get a shell as openfire",
        "Setting up a reverse socks proxy with chisel so we can hit ports listening on localhost",
        "Going over how the Openfire Auth Bypass works, using Unicode to bypass an acl"
      ]
    },
    {
      "name": "Soulmate",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Bruteforcing virtualhosts with ffuf",
        "Discovering CrushFTP, running nuclei which will get the version",
        "Playing with the soulmate.htb website while our recon runs",
        "Looking at CVE-2025-31161 which nuclei told us, its an exploit within CrushFTP then manually playing with the exploit",
        "Showing CrushFTP also leaks the version when requesting javascript files to load the page",
        "Finding a CVE that exploits this",
        "Showing we don't actually need to create a user with this exploit",
        "Changing the FTP Home Directory to the root webserver, which will let us upload a webshell",
        "Shell on the box, looking at the database",
        "Looking at running processes, discovering an erlang script"
      ]
    },
    {
      "name": "Spectra",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Nmaping the box",
        "Checking out the web pages, discovering Wordpress",
        "Getting the username of wordpress by looking at the blog post author",
        "Running WpScan with Plugins-detection",
        "Finding an open directory on the testing site, accessing a backup",
        "Attempting to login with MySQL but cannot due to the account only being allowed on localhost",
        "Logging into wordpress with administrator and the devteam01 password",
        "Getting a shell through WordPress by editing an unused theme",
        "Failing to get a reverse shell...",
        "Using a common PHP Reverse Shell",
        "Discovering we are on a ChromeBook"
      ]
    },
    {
      "name": "Spider",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Adding spider.htb to our host file so we can access the domain name",
        "Playing with the registration of the website and examining the cookie",
        "Putting a bunch of bad characters for our username and discovering odd behaviors",
        "Dumping the configuration via SSTI, can't do a complex SSTI due to username limit",
        "We have the cookie secret, using Flask-Unsign to create malicious cookies and discover SQL Injection",
        "Sending our SQL Injection Payload to the server and confirming it is SQL Injectable",
        "Using the Eval Parameter of SQLMap to have SQLMap Sign the payloads it sends and dump the database",
        "Getting Chiv's password from SQLMap then logging into the web application",
        "Testing SSTI on the admin panel that we got to from Chiv and discovering a WAF (Web Application Firewall)",
        "Using wfuzz to enumerate the bad characters which trigger the WAF"
      ]
    },
    {
      "name": "Stacked",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Start of Nmap",
        "Start of gobuster to enumerate VHOST and Files",
        "Showing how I like to find the needles in a haystack when it comes to parsing lots of data.",
        "Using google reverse image search to try to identify what a logo means",
        "Hunting for XSS, putting unique URL's in all fields (check for a callback later)",
        "Going over the Docker Compose file we had downloaded",
        "Discover our XSS Attack worked, looking for LocalStack CVE's and discovering one in the dashboard",
        "Start of exploiting the XSS",
        "Creating a CSRF to force the victim to navigate to pages and send us the date, read his email to discover an S3 Domain",
        "Start of looking at creating an AWS Lambda application",
        "Using aws cli to create a lambda function"
      ]
    },
    {
      "name": "Static",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Noticing there is weird behavior on /vpn, it doesn't direct to the folder /vpn/ probably reverse proxy [MasterRecon]",
        "Corrupted GZIP, using zcat to view it and fixgz to repair",
        "Building a Python Script to generate TOTP for MFA (the NTPDate failed because i didn't use -q.  Nmap would have worked with -sV)",
        "Talking about things I would be monitoring for on Login Forms [Detection]",
        "Talking about a common issue when layering VPN's (MTU). Won't fix it right now, since I want to display the weird behavior later",
        "VPN Connection established, looking at routes.  Adding additional routes that don't exist",
        "Going over the NMAP ran from the second VPN",
        "Fully understanding the weird behavior from /vpn earlier on. It is indeed a reverse proxy. [MasterRecon]",
        "Exploiting the fact that XDEBUG is enabled on info.php",
        "Running Chisel to create a pivot rhrough web to access mysql"
      ]
    },
    {
      "name": "Stocker",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Running Gobuster in VHOST Detection mode to find the dev subdomain",
        "Intercepting a request to dev.stocker.htb and seeing an connect.sid  cookie and x-powered-by header saying express, both indicating it uses NodeJS/Express",
        "Explaining why I'm trying these injections",
        "Bypassing login with mongodb injection by setting both username and password to not equals instead of equals",
        "Playing with the e-commerce store and seeing it gives us a PDF",
        "Using exiftool to see how the PDF was generated",
        "Inserting an HTML IFRAME when we purchase an item to see if the PDF Generated will include local files",
        "Extracting /var/www/dev/index.js and getting the mongodb password which lets us log into the server",
        "The order numbers don't appear to be that random, looking at the source code to identify how this is generated. It's just mongo's object ID which is heavily based upon time stamps",
        "Looking at sudo, we can perform a directory traversal to execute run any .js file as root"
      ]
    },
    {
      "name": "Stratosphere",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of recon",
        "Manually checking the page out",
        "Discovering the webserver is java/tomcact",
        "Starting up GoBuster / Hydra",
        "The Directory /Monitoring was found - Discovering its Struts because of .action",
        "Stumbling upon an exploit trying to find out how to enumerate Struts Versions",
        "Searching Github for CVE-2017-5638 exploit script, exploiting the box to find out its firewalled off",
        "Using a HTTP Forward Shell to get around the strict firewall",
        "# Sokar Video Explaining it: https://www.youtube.com/watch?v=k6ri-LFWEj4",
        "# Inception - Another box where i modify the FWD Shell POC: https://www.youtube.com/watch?v=J2I-5xPgyXk&t=3s",
        "Go here if you want to start copying the Forward Shell Script",
        "Explaining how it works"
      ]
    },
    {
      "name": "StreamIO - Manually Enumerating MSSQL Databases, Attacking Active Directory, and LAPS",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap, discovering it is an Active Directory Server and hostnames in SSL Certificates",
        "Running Feroxbuster and then cancelling it from navigating into a few directories",
        "Examining the StreamIO Website",
        "Finding watch.stream.io/search.php and",
        "Fuzzing the search field with ffuf by sending special characters to identify odd behaviors",
        "Writing what we think the query looks like on the backend, so we can understand why our comment did not work.",
        "Burpsuite Trick, setting the autoscroll on the repeater tab",
        "Testing for Union Injection now that we know the wildcard trick",
        "Using xp_dirtree to make the MSSQL database connect back to us and steal the hash",
        "Extracting information like version, username, database names, etc from the MSSQL Server",
        "Extracting the table name, id from the sysobjects table"
      ]
    },
    {
      "name": "Sunday",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Begin of NMAP Discovery of Finger",
        "Enumerating Finger with Finger-User-Enum",
        "Nmap'ing all port quickly by lowering max-retries",
        "Adding an old Key Exchange Alogorithm to SSH",
        "Showing Hydra doesn't work, then using Patator",
        "(Patator also can do Finger Enum!  Try it out)",
        "Using find to count lines in all wordlist files",
        "Logged in with sunny:sunday",
        "Grabbing /backup/shadow.backup and cracking sha256crypt with Hashcat",
        "Just noticed this box is oooooold, try to privesc with sudo and ShellShock (Fail)",
        "Privesc by overwriting the /root/troll binary",
        "== Box Done"
      ]
    },
    {
      "name": "Support",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Start of nmap",
        "Running CrackMapExec to enumerate open file share and downloading a custom DotNet Executable",
        "Showing that we can run DotNet programs on our linux machine (will show how I configured this at the end of the video)",
        "Using Wireshark to examine DNS Requests when running this application",
        "Using Wireshark to examine the LDAP Connection and discover credentials being send in cleratext",
        "Using the credentials from the program to run the Python Bloodhound Ingestor",
        "Playing around in Bloodhound",
        "Discovering the Shared Support Account has GenericAll against the DC",
        "Doing a LDAP Search to dump all information and finding a password stored in the Info field of Active Directory",
        "Examining what the Support user can do, showing the importance of looking at Outbound Object Control option in bloodhound",
        "Explaining how to abuse GenericAll to the Computer object"
      ]
    },
    {
      "name": "Surveillance",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering an exploit for Craft CMS, it doesn't work out of the box because of a typo on exploit-db looking into this exploit",
        "Walking through the Exploit Script",
        "Getting a shell on the box with the script that was on Github",
        "Logging into the CraftCMS Database, finding the password",
        "There is a backup of the database in the storage directory, which contains an old password for Matthew",
        "Linpeas shows us configurations for ZoneMinder, which lets us into another table of the database",
        "Setting a port forward so we can access ZoneMinder, then updating the password so we could login (not needed but fun to do)",
        "Showing an unauthenticated exploit in ZoneMinder",
        "The ZoneMinder user can run zoneminder scripts with sudo",
        "Finding a command injection in ZMUPDATE, getting shell as root"
      ]
    },
    {
      "name": "Swagshop",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Begin of recon",
        "Examining the web page to find Magento, noticing /index.php/ mod-rewrite misconfig and old copyright",
        "Whoops should of done apt search magescan, either way this package is not in Kali",
        "Running MageScan to scan the website",
        "Finding an open configuration file (app/etc/local.xml)",
        "Running searchsploit to identify public exploits",
        "Examining an exploit that will add an administrative user via SQL Injection",
        "Running the exploit out of the box didn't work, send it through burp in order to debug it",
        "Exploit needed to be modified to include index.php due to mod-rewrite misconfig",
        "Going back to SearchSploit and using the Authenticated RCE Exploit",
        "Making the obvious changes to fix the exploit script",
        "Debugging the exploit by running it through burpsuite, find out we need to use an login page"
      ]
    },
    {
      "name": "Tabby",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of Nmap",
        "Taking a look at the web page",
        "Discovering Megahosting.HTB and adding it to /etc/hosts",
        "Playing with news.php and explaining the logic of LFI",
        "Discovering it is a file_get_contents(), which means we can skip all our \"RCE Tests\" as it won't execute PHP Code",
        "Poking at Tomcat and hunting for its tomcat-users.xml file to use with our LFI on apache2",
        "Uploading a JSP Webshell to tomcat with credentials found in tomcat-users.xml",
        "Using Curl to upload the JSP webshell.",
        "Whoops was uploading to the wrong port and then forgot to convert the JSP to a WAR File",
        "Reverse shells having trouble running due to bad characters.",
        "Downloading the shell to disk, then executing it in order to avoid special characters"
      ]
    },
    {
      "name": "Talkative",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Taking a look at websites, making note of all login prompts (bolt, rocketchat)",
        "Start of looking at Jamovi, using the Rj Editor to execute code and get a reverse shell",
        "Using cat to send files over the network to our box and viewing the bolt-administration document",
        "Taking a credential from the document and logging into Bolt CMS",
        "Editing a theme in bolt to give us code execution",
        "Using script to get a full PTY since python isn't on this box",
        "Looking for passwords for bolt, finding a sqlite database",
        "Getting the ip address of the box via the hostname command since ifconfig and ip were not on the box",
        "Using /proc/net/tcp to get listening ports",
        "Using the docker container to SSH into the host computer via its docker IP"
      ]
    },
    {
      "name": "Tally",
      "os": "Windows",
      "difficulty": "Hard",
      "techniques": [
        "Start of NMAP",
        "Begin of Sharepoint/GoBuster (Special Sharepoint List)",
        "Manually browsing to Sitecontent (Get FTP Creds)",
        "Mirror FTP + Pillage for information, Find keypass in Tim's directory and crack it.",
        "Mounting/Mirroring ACCT Share with found Creds and finding hardcoded SQL Creds",
        "Logging into MSSQL with SQSH, enabling xp_cmdshell and getting a Nishang Rev Shell",
        "Finding SPBestWarmUp.ps1 Scheduled Task that runs as Administrator",
        "Begin of RottenPotato without MSF (Decoder's Lonely Potato)",
        "Using Ebowla Encoding for AV Evasion to create an exe for use with Lonely Potato",
        "Lonely Potato Running to return a Admin Shell",
        "### BOX DONE",
        "Finding CVE-2017-0213"
      ]
    },
    {
      "name": "Tartarsauce",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of recon",
        "Discovery of Wordpress and fixing broken links with burp",
        "Start of WPScan",
        "Start of poking at Monstra, (Rabbit Hole)",
        "Back to looking at WPScan, Find Gwolle Plugin is vulnerable to RFI Exploits",
        "Reverse shell returned as www-data",
        "Confirming monstra was read-only",
        "Running LinEnum.sh to see www-data can run tar via sudo",
        "Use GTFOBins to find a way to execute code with Tar",
        "Begin of Onuma user, use LinEnum again to see SystemD Timer of a custom script",
        "Examining backuperer script",
        "Hunting for vulnerabilities in Backuperer"
      ]
    },
    {
      "name": "Teacher",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Begin of recon",
        "Poking around at the website to identify what techologies it utilizes",
        "Discovering something odd about images/5.png",
        "Downloading 5.png to discover it is a text file with a portion of a password",
        "Finding a place to login (/moodle), attempt to enumerate valid usernames",
        "Using wfuzz to bruteforce the password",
        "Looking for a way to enumerate Moodle Versions",
        "Searching for exploits for this version and finding \"Bad Teacher\"",
        "Start of manually exploiting this vulnerability",
        "Adding a \"Calculated Question\" which has the formula (vulnerable) parameter",
        "Finding artifacts of creating/testing the machine which spoils what we are supposed to do",
        "Fixing our forumla to allow for code execution"
      ]
    },
    {
      "name": "Tenet",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Discovering wordpress, fixing our host file",
        "Running wpscan to enumerate wordpress via aggressive mode",
        "Manually enumerating wordpress users by listing blog posts by author",
        "Discovering Sator.php, then using GoBuster to discover hidden backups to find Sator.php.bak",
        "Start of looking at the php source to see its a basic deserialization challenge.",
        "Building the deserialization gadget to write a file",
        "Uh oh.  Made a typo, thankfully can find it quickly and get RCE",
        "Going back a step and showing a proper way to troubleshoot it",
        "Getting a reverse shell then examining wordpress config to get some credentials",
        "Testing the credentials with SSH and logging in with neil"
      ]
    },
    {
      "name": "Tentacle",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Running nmap and giving it capabilities so we don't need to use sudo",
        "Discovering an email on the SQUID Page",
        "Running GetNPUsers since Kerberos is running, end up getting a hash we can't crack",
        "Attempting to enumerate DNS, coming up with nothing",
        "Using GoBuster to bruteforce DNS Names",
        "Using Curl to send requests through Squid to the new Domains",
        "Mistake here, swapped the IP Addresses :(",
        "Using ProxyChains to create a proxy through Squid",
        "Nmaping through our ProxyChains, need to use the -sT flag",
        "Enabling Quiet Mode of ProxyChains to make it less verbose",
        "Comparing nmap banners/version to see if these ports go to anything new"
      ]
    },
    {
      "name": "TheFrizz",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering Gibbon LMS is running and enumerating the version",
        "Using CVEDetails to look at CVE's for Gibbon, then discovering an unauth file upload",
        "Getting a shell by uploading a malicious PHP Script",
        "Using the MySQL binary to dump the database to get the password hash",
        "The password is salted, searching Gibbon Source Code for how the salt is used so we know which hashcat ruleset to use",
        "Running RustHound, doesn't really tell us too much",
        "Using SSH with Kerberos to login to the box, showing the hostfile needs to have the box name as the first item",
        "Going into the recycle bin, discovering a deleted file and then copying it to our box and discovering a zip which has a password",
        "Using our bloodhound data to build a userlist then spray the password",
        "Logging in with m.schoolbus then running SharpGPOAbuse to get the domain controllers to run a command"
      ]
    },
    {
      "name": "TheNotebook",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Checking out the webpage, trying to identify the language running the page",
        "Exploring how Add Note works and testing SSTI/SQL/XSS",
        "Checking out the cookie to see how the JWT is encoded",
        "JWT.IO shows the JWT is RS256 and there's a URL for the privKey",
        "Editing the PrivKEy, I'm not sure why i didn't do this within the JWT.IO website...",
        "Confirming the server goes to us to get the PrivateKey",
        "Using ssh-rsa/openssl to create a RSA Key and forging the JWT",
        "Exploring the IDOR Vulnerability to see if unauthenticated users can access notes",
        "Uploading a PHP File to confirm code execution then a reverse shell.",
        "Identifying when the box was created by looking at SSH Host Keys, then using find to list files created around that time"
      ]
    },
    {
      "name": "Time",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Poking at the website",
        "Finding a way to generate error messages",
        "Researching the error message",
        "Throwing a random exploit from the internet and getting a new error",
        "Trying another exploit but this one will make a HTTP Request back to our server",
        "Testing RCE with this exploit with a simple ping",
        "RCE Confirmed switching to a reverse shell",
        "Running LinPEAS",
        "Exploring the custom System Backup Timer Service",
        "Editing the Timer Backup Shell Script to get Root"
      ]
    },
    {
      "name": "Timelapse",
      "os": "Windows",
      "difficulty": "Easy",
      "techniques": [
        "Start of nmap",
        "Enumerating the file server",
        "Cracking the zip file with John",
        "Cracking the pfx file (PKCS12) with John",
        "Extracting the certificate and key from the pfx file",
        "Using evil-winrm to login with the certificate",
        "Checking the PSReadline file and getting another credential",
        "Logging in with svc_deploy, failing to run bloodhound",
        "Running net user discovering we are in LAPS Group",
        "Running get-adcomputer to get the LAPS Password",
        "Showing a python script to extract LAPS Passwords"
      ]
    },
    {
      "name": "Timing",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Running feroxbuster and discovering image.php",
        "Fuzzing image.php for parameters and discovering an LFI",
        "Enumerating the WAF to find blacklisted strings and then using a php filter to extract source",
        "Examing the login.php source code and discovering a timing attack",
        "Demonstrating attempting to login with valid users takes a longer time so we can bruteforce users",
        "Creating a python script to enumerate users",
        "Logging in with aaron:arron (guessed the password)",
        "Extracting upload.php and admin_auth_check.php to see how we can upload files",
        "Attempting a mass assignment vulnerability on profile_update.php and discovering we can change our roles",
        "Discovering a timing attack to discover filenames uploaded, which can be chained with our LFI to execute code"
      ]
    },
    {
      "name": "Titanic",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Intercepting the booking download and finding the File Disclosure Vulnerability",
        "Finding the dev.titanic.htb host and discovering Gitea",
        "Running Gitea locally via docker to see how where it stores the configuration and database",
        "Downloading the Gitea Database and cracking it",
        "Using gitea to spray passwords via ssh and logging into the box as developer",
        "Discovering a script in /opt/scripts/ and discovering a script that writes to a log which is populated every minute",
        "Searching for vulnerabilities in Image Magick",
        "Getting code execution by exploiting CVE-2024-51817 in ImageMagick"
      ]
    },
    {
      "name": "Toby",
      "os": "Linux",
      "difficulty": "Insane",
      "techniques": [
        "Start of nmap",
        "Discovering backup.toby.htb and discovering GOGS",
        "Discovering a backup project in toby-admin, which is wordpress",
        "Downloading and running php malicious file scanner and finding a backdoor in the web code",
        "Finding the backdoor in comment.php and finding out its packed a bunch of times. Using a loop to get it back to the original code.",
        "Analyzing the depacked malware, to see it will run a function on a specially crafted comment",
        "Placing the comment which should trigger the backdoor, then analyzing what happens",
        "Wireshark shows the box starts a request on port 20053, listening and discovering it sends us data encryped with our secret",
        "Changing the secret to be 00, so it doesn't xor anything making it a bit easier for us to analyze",
        "Sending it a command by XOR'ing it with the key the server sends back to us",
        "Creating a python script to automate this"
      ]
    },
    {
      "name": "Tombwatcher",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Running RustHound with the credentials we were given",
        "Clicking outbound control a few times from Henry to see an obvious (but long) attack path",
        "Using BloodyAD to perform the Targeted Kerberoast attack",
        "Using BloodyAD to add ourself to a group then NetExec to reaed GMSA Passwords",
        "Using BloodyAD to change the password of a user and then use Certipy to create a Shadow Credential for the next user",
        "Looking at certificates in Bloodhound and Certipy to see one certificate has a SID under Enrollers",
        "Using powershell to show and restore deleted objects",
        "Running Certipy with Cert_Admin to see it is vulnerable to ESC15",
        "Performing ESC15 by generating a certificate with Certificate Request Agent property, which then lets us generate an administrator certificate to get root",
        "Beyond Root: Fixing the CA_MD_TOO_WEAK error by creating a new OpenSSL Config and not using UV to run certipy"
      ]
    },
    {
      "name": "Topology",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering Discovering the LaTeX Equation Generator Page",
        "Attempting to get code execution, discovering a WAF. Building a wordlist and using FFUF to identify potentially dangerous commands that aren't blocked",
        "Discovering lstinputlisting is not blocked, which will let us read files",
        "Using FFUF to bruteforce subdomains, show the automatic calibration, so you don't need to manually specify filters",
        "Looking for the Apache Config for the Dev subdomain, as it likely has a htpasswd file we can get a password from",
        "Showing the alternate path to get RCE, Bypassing the filter by encoding characters in hex with ^^",
        "Talking about the catcode command and a failed path at evading a filter with this, but it pointed me towards superscript",
        "Looking at the wikibooks latex page and seeing ^ is superscript by default, so we don't need the catcode",
        "Testing the bypass with a valid command to make sure it works",
        "Writing a file"
      ]
    },
    {
      "name": "Traceback",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Checking the web page, then running a SecList wordlist for CommonBackdoors",
        "GoBuster returned smevk.php",
        "Attempting to guess the password, get in with admin:admin",
        "Running script prior to my reverse shell to log the output... I forget to check this again but it did work!",
        "Reading note.txt which hints at finding a LUA File, using find to hunt for files",
        "The reverse shell is misbehaving, lets fix it by setting the the rows/columns",
        "Running LinPEAS, discover sudo with luvit; then looking up how to write files with a lua script",
        "SSH'ing in with SysAdmin after our key was written",
        "Using find some more to hunt for interesting files",
        "Using find to search between dates of interest shows an interesting backup directory",
        "Running pSpy to search for running processes"
      ]
    },
    {
      "name": "Travel",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of recon, discovering a bunch of hostnames in a cert",
        "Running wpscan against blog.travel.htb",
        "Running the raft-large-files.txt against blog-dev.travel.htb to discover the git repo",
        "Using git-dumper to download the git repo",
        "Examining the git project to discover what it is and where its installed on the webserver",
        "Discovering a debug file",
        "Hunting for where web app accepts user input",
        "Getting the server to make a request back to us",
        "Examining what debug.php is telling us (memcache)",
        "Hunting around wordpress/simplepie to see how it is using memcache",
        "Begin of trying to poison the memcache object, talking about bypass the ip filter via hex encoding the ip"
      ]
    },
    {
      "name": "Traverxec",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Running nmap against the box, port 80 is running a unique webserver (nostromo)",
        "Lets check out the website before we throw any exploits",
        "Launching metasploit then exploting Nostromo but sending the exploit through burpsuite to see what it is doing",
        "Code Execution worked, for some reason the proxies command didn't work the first time",
        "Explaining why the script does a GET request before throughing an exploit (Exploit Verification)",
        "Editing the payload to send a Bash Reverse Shell",
        "Running LinPEAS",
        "Running LinEnum in Thorough mode",
        "Going over LinPEAS Output",
        "Going over LinEnum Output",
        "Discovering a HTPASSWD Password, then using hashcat to crack it",
        "Looking at the HTTP Configuration file to discover public_www directory in home directories"
      ]
    },
    {
      "name": "Trick",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Poking at the DNS Server and discovering its hostname when querying itself",
        "Using dig to show the reverse lookup aswell, then perform a zone transfer with axfr",
        "Just showing dnsrecon to bruteforce a range of IP's, not really relavent to this but figured I'd show it",
        "Poking at the website and logging into the website",
        "Finding an LFI that allows us to disclose PHP Source code, can't do much else because it appends .php to our string",
        "Using SQLMap with the login to extract files",
        "SQLMap only found time injection, changing the levels and specifying the techniques which allows it to find a quicker method",
        "Having SQLMap extract the nginx configuration and discovering another subdomain",
        "Checking out the new domain preprod-marketing.trick.htb, discovering an LFI but this time the extension is in the URL!",
        "Going over the source code of the LFI to show why this was vulnerable the ../ strip was not recursive"
      ]
    },
    {
      "name": "Trickster",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Showing the Shop Subdomain via ffuf",
        "Performing a gobuster attack, need to update the user agent because everything returns 403 at first (WAF)",
        "Discover .git, then running git-dumper to download the .git directory and discover the unique admin directory",
        "Discovering Prestashop 8.1.5 which is vulnerable to CVE-2024-34716, downloading and running the XSS/CSRF Exploit",
        "Finding the Prestashop configuration file, dumping password hashes, use information_schema table to identify tables that contain the column password",
        "Cracked James password, ssh into the box, forward a port and discover a new web application ChangeDetection",
        "Building a SSTI Payload for CVE-2024-32651 in ChangeDetection to get a shell on docke",
        "Discovering the Datastore directory in the docker container, it has backup files compressed with Brotli, downloading and decompressing",
        "Discovering Adam's password, who can sudo with PrusaSlicer, finding a RCE in it",
        "Changing the filename of PrusaSlicer, then getting a root shell"
      ]
    },
    {
      "name": "TwoMillion",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of nmap, scanning all ports with min-rate",
        "Browsing to the web page and taking a trip down memory lane with the HackTheBox v1 page",
        "Attempting to enumerate usernames",
        "Solving the HackTheBox Invite Code Challenge",
        "Sending the code to JS-Beautify",
        "Sending a curl request to /api/v1/invite/how/to/generate to see how to generate an invite code",
        "Creating an account and logging into the platform then identifying what we can do",
        "Discovering hitting /api/v1/ provides a list of API Routes, going over them and identifying any dangerous ones",
        "Attempting a mass assignment vulnerability upon logging in now that we know there is an is_admin flag",
        "Playing with the /api/v1/admin/settings/update route and discovering we can hit this as our user and change our role to admin",
        "Now that we are admin, playing with /api/v1/admin/vpn/generate and finding a command injection vulnerability"
      ]
    },
    {
      "name": "Unattended",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of recon",
        "Running GoBuster to discover /dev and index.php",
        "Checking out the web application",
        "Discovering SQL Injection in ID and playing with it",
        "Running SQLMap to dump pieces of the database",
        "Nginx Misconfiguration, missing trailing slash",
        "Downloading source code of the application",
        "Exploring the source of the application",
        "Specifying an error string in SQLMap to have it do boolean logic versus time-based",
        "Installing a Docker LAMP Server to run the web application",
        "Finally got the application running locally (Missed a comma which created a lot more work)",
        "Analyzing the SQL Injection with Debug turned on to see how it works"
      ]
    },
    {
      "name": "Unbalanced",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Setting Squid up to do a portscan while we work on something else",
        "Poking at RSYNC and seeing we can download encrypted config backups",
        "Examining files downloaded from RSYNC, specifically looking at entropy to validate encryption",
        "Finding the EncFS Config file, and then using John to Crack it",
        "Decrypting the config directory and finding a squid password and some hostnames",
        "Examining the new website exposed to us, configuring BurpSuite to use the squid proxy",
        "Showing the Intranet-Host header is changing, then accessing Squid Cache Manager to find some more ip addresses",
        "Using curl to view Squid Cache Information",
        "Finding a new IP Address for a decomissioned server.  Looks like this one has a vulnerability",
        "Poking at the login form on the intranet-host1, looks like its vulnerable to SQL Injection"
      ]
    },
    {
      "name": "Underpass",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Checking if SNMP is open and then installing the MIBS so we get more readable output",
        "Discovering the Daloradius directory and if we specify files in it we can get output. Logging in with default credentials",
        "Discovering Daloradius shows password hashes of users, cracking and logging in",
        "The svcMosh user can run MOSH (Mobile Shell) as root, running the server and then connecting to it"
      ]
    },
    {
      "name": "Undetected",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Taking a look at the website",
        "Running gobuster against store.djewelry.htb and discovering a vendor directory that has phpunit",
        "Exploiting phpunit to get a shell on the box",
        "Shell recieved on the box as www-data",
        "Looking for files owned by www-data on the box by using find to discover /var/backups/info",
        "Running strings against the /var/backups/info file and discovering a hex string that is a shell script. Using CyberChef to decode it and gain access to steven",
        "ssh in as steven, talking about the duplicate users as steven and steven1 have the said uid/gid",
        "Talking about timestamps, my favorite way to find tools left behind by hackers",
        "Using find -type f -printf \"%T %p\\n\"to show the full time stamp for files",
        "Using find to find files that were created 00:00:00, which is an indication of time stomping. Discovering a backdoored copy of sshd"
      ]
    },
    {
      "name": "Unicode",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Registering and logging in and examining what a regular user can do",
        "Playing with the file upload capability",
        "Discovering there is a JWT in our HTTP Request, examining it to see it is RS256 and has a claim",
        "Explaining how we are going to exploit the Claim Misuse vulnerability in this JWT",
        "Creating a JWT Header that will have a modified URL for the claim, website says its an invalid key but doesn't reach out to us",
        "Using the redirect functionality on the web page to allow us to place the websites domain in our JKU Claim",
        "Modifying the JWK File to place our own RSA Key and generating one with ssh-keygen and openssl",
        "Showing us pulling N and E out of the RSA Key",
        "Converting the SSH Public key into a Certificate",
        "Updating the JWT to change our name to admin and finding a LFI Vulnerability"
      ]
    },
    {
      "name": "University",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Looking at the website, discovering it is Django",
        "Exporting a profile, discovering it is using ReportLabs and xhtml2pdf",
        "Confirming RCE in Report Labs with ping, then getting a reverse shell",
        "Shell on the box, downloading the db, ca, and finding a password",
        "Running Rusthound and then looking into bloodhound",
        "Discovering other machines, getting the IP Addresses via DNS and/or powershell. Then setting up Chisel",
        "Testing our WAO Credential against the windows and linux machine, discovering we get on both. Can skip to MITM6/NTLMRELAYX if we want from here",
        "Signing our own certificate with the CA we downloaded earlier, then logging in with Nya.  Then creating a malicious shortcut and using GPG to sign it",
        "Shell as Martin",
        "Showing a good GuidePoint article on Kerberos Delegation"
      ]
    },
    {
      "name": "Unobtainium",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Downloading and installing the deb package with dpkg, then fixing the host file",
        "Running wireshark when examining the unobtainium application then examining the HTTP Requests",
        "Proxying the unobtainium app through Burpsuite by creating a new proxy listener and updating the host file",
        "Playing with the LFI on /todo and discovering we can only cause errors or include files in the local directory",
        "Using FFUF to attempt to find other JS Files with this LFI",
        "Copying the index.js source code and looking for vulnerabilities",
        "Discovering hard coded credentials, examining the administrator password to see there would be too much entropy to bruteforce",
        "Analyzing the upload functionality to discover an RCE if we can upload",
        "Discovering a merge command and looking up Prototype Pollution to potentially update our user object with the upload permission",
        "Giving ourself the Upload Functionality then performing the RCE in Upload"
      ]
    },
    {
      "name": "UpDown",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Testing the webhook, examining the request the server makes",
        "Trying other URL Wrappers to see how the application behaves",
        "Finding the .git sub directory, running git-dumper to extract source code",
        "Finding and explaining the LFI Vulnerability",
        "Attempting to use the php filter to extract source code, does not work, turns out there's another website",
        "Discovering there is a special header requried to access the DEV Website",
        "Configuring BurpSuite to add the header for us",
        "Explaining the LFI And why we are going to use a phar file to get code execution",
        "Attempting to get a shell, when executing our file we get a ERROR 500. Simplify the payload to see it works.",
        "Examining phpinfo to see disabled functions, and discovering system() was blocked"
      ]
    },
    {
      "name": "Usage",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Discovering the page is Laravel based upon cookies",
        "Discovering the SQL Injection in Reset Password, then running SQLMap screwing up our results because we logged out in middle of SQLMap",
        "Cracking the user out of admin_users",
        "Logging into admin.usage.htb and discovering a vulnerable Laravel Admin, which is vulnerable to PHP File Upload in the avatar",
        "Shell returned on the box",
        "Discovering we can run 7z with sudo and the Wildcard Spare Trick will let us read files"
      ]
    },
    {
      "name": "Valentine",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of Recon, identifying end of life OS from nmap",
        "Running vulnerability scripts in nmap to discover heartbleed",
        "(In video on Blue, I go a bit more in NMAP Scripts. https://www.youtube.com/watch?v=YRsfX6DW10E)",
        "Going to the HTTP Page to see what it looks like",
        "Begin of Heartbleed - Grabbing Python Module",
        "Explaining Heartbleed -- XKCD ftw",
        "Explaining and running the exploit",
        "Exporting large chunks of memory by running in a loop",
        "Finding an encrypted SSH Key on the server",
        "Examining heartbleed output to discover SSH Key Password",
        "SSH as low priv user returned",
        "Finding a writable tmux socket to hijack session and find a root shell"
      ]
    },
    {
      "name": "Vault",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of Recon",
        "Begin of GoBustering",
        "Discovery of an image upload script",
        "Attempting to bypass the upload filter",
        "Reverse Shell to ubuntu Returned.  Examining Web Source",
        "ALTERNATIVE: Checking out the host name pollution, setting host header to localhost",
        "Resume of poking around the host, discover passwords and other hosts in /home",
        "Uploading a static-compiled nmap to the box (static-binaries is a github repo)",
        "SSH Local Port Forward and Dynamic, to let our Kali box communicate with the next hop.",
        "Discovery of a page that lets us create ovpn (openvpn) configs and test the VPN",
        "Think i broke the box here, sent unicode to the box.... It stops responding on web.",
        "Machine reverted, getting back to where I started."
      ]
    },
    {
      "name": "Vessel",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Introduction talking about how this box is about finding CVE's and building an exploit based upon exploit",
        "Start of nmap",
        "Running gobuster and showing the importance of using multiple wordlists.",
        "Attempting to register an account, which shows the endpoint /api/register but /api/ returns a 404",
        "Showing that raft-small-words wordlist won't discover .git but commons.txt will because commons has .git/HEAD",
        "Running Git-Dumper to extract the source then looking at the code",
        "Showing the vulnerable code and how secure the code appears at first glance without knowing specifics about the library",
        "Googling MySQLJS Sql Injection and showing how you would have found this exploit",
        "Showing how you could have found it blindly, passing an object into the SQL Query and doing SQL Injection on NodeJS with MySQL",
        "Logging in and finding OpenWebAnalytics version 1.7.3, finding a CVE and writeup for the vulnerability",
        "Showing the piece missing from the writeup that tells us how we can retrieve the cache file that can be used to reset a password",
        "Going over the code, and figuring out how the filename is generated."
      ]
    },
    {
      "name": "Vintage",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Running Bloodhound",
        "Bloodhound, Shortest Path to Tier 0 shows us two ADM users which can add themselves to Delegated Admins",
        "Dumping Password set time of users in bloodhound with JQ to see any passwords set at the same time",
        "Discovering the GMSA account, looking at it and discovering it can add themselves to ServiceManagers and that FS01 can ReadGMSAPassword",
        "FS01 is a member of the Pre Windows 2000 Compatible Access Group, which sets the password of the account to the hostname of the box",
        "NXC failed us, using bloodyAD to read the GMSA Password",
        "Opening up wireshark to look at why NXC Failed but BloodyAD Worked, quickly modifying NXC to fix the issue (it defaulted to ldaps when gmsa is used)",
        "Bloodhound, Looking at what ServiceManagers can do, it has GENERICALL to many service accounts, one is disabled.",
        "Using BloodyAD to re-enable the SVC_SQL account and then running TargetedKerberoast to dump hashes, also manually dump them with bloodyad and nxc by setting an spn",
        "Spraying the password from SVC_SQL with users of the domain, finding c.neri has the same password"
      ]
    },
    {
      "name": "Visual",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Examining the request the server makes to us",
        "Using docker to run a Gitea Instance",
        "Using docker to install a DotNet Container (make sure its the SDK!)",
        "Using the dotnet CLI to create a project and adding a solutions file to it",
        "Having the webapp download our repo, then looking at PreBuildEvents to execute commands before it is compiled",
        "Talking about why this PreBuildEvent exists",
        "Looking at why our build failed",
        "Adding a nishang reverse shell to the prebuild event",
        "Reverse Shell Returned!",
        "Writing a webshell as Enox, to get a shell as the Apache Service User"
      ]
    },
    {
      "name": "Voleur",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Running RustHound",
        "Running smbclient with Kerberos, to login to the fileshare as Ryan and downloading/cracking a word document with password",
        "Opening the Access Review Document, discovering multiple credentials and looking at bloodhound to see what we can do",
        "Performing a TargetedKerberost to gain access to the WinRM Account and then using RunasCS to gain a shell as SVC_LDAP",
        "Using the AD Powershell Module to restore a deleted user",
        "Showing we didn't need a shell to restore the deleted user, doing it manually first showing ldapsearch can see deleted users then running the tombstone netexec module",
        "Todd.Wolfe is a member of second-line technician.  Looking at the fileshare to discover his user backup",
        "Running Netexec Spider_Plus to dump the fileshare and discovering DPAPI Saved Blobs",
        "Using impacket-dpapi to decrypt the dpapi data that was in the backup",
        "Getting access to Jeremy.Combs, who has SSH Access to the box"
      ]
    },
    {
      "name": "Waldo",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Begin of Recon",
        "Looking at what Filtered means in Nmap",
        "Start of looking at webpage (GoBuster)",
        "Manual HTTP Enumeration",
        "Start of exploiting with BurpSuite",
        "SSH Key Found, logging in with nobody",
        "Discovering a second SSH Server",
        "Using the same SSH Key to login to the second SSH Server as monitor",
        "Escaping rBash by modifying an executable file in our current $PATH",
        "Running LinEnum.sh to search for PrivEscs",
        "Enabling ThoroughTests in LinEnum to see what else it will check",
        "Looking into capabilities permission sin linux"
      ]
    },
    {
      "name": "Wall",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of recon",
        "Running GoBuster to discover the /monitoring directory",
        "Running hydra to try to brute force the HTTP Authentication (Does not work due to it being a secure password)",
        "Bypassing the AUTH Request by changing to a POST \u2014 Explain why this works later",
        "Looking at the Centreon Changelog to look for any exploits",
        "There aren\u2019t any unauthenticated exploited, lets brute force a login.  The main way uses a CSRF Token.",
        "Bypassing the CSRF by using the Centreon API",
        "Using wfuzz to brute force the API Login and get admin:Password1",
        "Changing the Monitoring Engine Binary under Configure Pollers to get code execution",
        "Trying to ping ourselves, find out we can\u2019t use space",
        "Using IFS to instead of space",
        "Ping worked, trying to do a Reverse Shell"
      ]
    },
    {
      "name": "WhiteRabbit",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Playing with a JavaScript Client app (Vue) to get information to do recon and finding public /status/ page",
        "Looking at the N8N Workflow with GoPhish",
        "Looking at the JSON Schema File that leaks a secret key and shows possible SQL Injection",
        "Using CyberChef to test the HMAC Key and confirm we can sign payloads",
        "Switching to Caido to show we can create WorkFlows on the Replay (repeater) functionality",
        "Creating a convert workflow to HMAC Sign all our requests",
        "Using the MITM Python Library to quickly write a proxy that would sign our requests that makes it easier for tools to test this endpoint",
        "SQLMap found the injection, dumping tables discovering a restic password",
        "Using the restic CLI to download a backup, then cracking the 7z file. Cracking fails the first time due to a weird collision.",
        "On the box, we can run restic with sudo, use password-command to give us a root shell"
      ]
    },
    {
      "name": "Wifinetic",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Using wget to download all files from FTP then examining files, taking notes of the usernames",
        "Taking a look at the backup, discovering a password in the wireless config",
        "Using CrackMapExec to spray SSH with our password and getting a success with netadmin",
        "Running LinPeas to discover Reaver has the capability cap_net_raw",
        "Explaining why Reaver has this capability is interesting",
        "Running Reaver to attempt to brute force the WPS Pin and getting the WPA PSK which is also the root password",
        "Start of building a bash script to spray a single password across valid users with su",
        "Converting our script into a Bash Function so its easier to run without touching disk",
        "Talking about WPS and how this exploit worked",
        "The first vulnerability in the WPS Pin, the eighth digit is just a checksum"
      ]
    },
    {
      "name": "WifineticTwo",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of nmap",
        "Discovering OpenPLC, looking for default credentials and logging in with openplc:openplc",
        "Uploading a C reverse shell to OpenPLC",
        "Talking about our shell hanging our webserver, showing a POC that runs system() to background a process which seems to be smart",
        "Discovering a Wireless NIC, running IW to see wireless networks and OneShot to attack WPS",
        "Joining the Wireless Network, showing how important it is to tell DHCLIENT to not update default routes",
        "Cheating to get a root shell, so we can show the routing table of the container that can no longer talk to us",
        "Adding unset new_routers to a DHCLIENT Enter Hook so it doesn't update routes",
        "Once we get on the Wireless Network we can SSH to OpenWRT and get the root flag",
        "Showing we could exploit OpenWRT through the web interface aswell, setting up a pivot with Chisel",
        "Logging into OpenWRT with a blank password, going to the Scheduled Tasks to create a cron"
      ]
    },
    {
      "name": "Worker",
      "os": "Windows",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Checkign out the open SVN Port",
        "Adding the discovered domains to /etc/hosts and checking out the websites",
        "Some grep magic to show only what we want, which is URLS",
        "Using GoBuster to see if there are any more more VHOSTS",
        "Checking out the SVN and seeing creds in a previous revision (commit)",
        "Logging into Azure Devops (devops.worker.htb) and discovering the pipelin to deploy master branch to a server",
        "Pushing our webshell to the git master branch and getting shell on the box",
        "Choosing the revshell out of the tennc github page",
        "Creating a powershell one liner to get a reverse shell via Nishang",
        "Discovering SVN Credentials and using CrackMapExec to find valid passwords"
      ]
    },
    {
      "name": "Writer",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Discovering admin login page, running SQLMap and discovering it is SQL Injectable",
        "Testing for SQL Injections in the username and password, discovering injection in the username",
        "The adminsitrative interface lets us upload images, failing to upload a PHP Shell",
        "Using the SQL Union Injection to extract source code via Load_file, then creating a python script to automate it",
        "Creating a Regular Expression in Python to grab only the data we want and be multiline",
        "Downloading a good LFI Wordlist and then using it with our python script to find interesting files",
        "Finding the apache configuration which gives us where the web application lives",
        "Updating our LOAD_FILE command to utilize TO_BASE64 in order to get around the web application doing HTML Entity Encoding",
        "Discoving an hardcoded password in the python flask web application",
        "Discovering command injection in how the web application handles URL's"
      ]
    },
    {
      "name": "Writeup",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Start of recon identifying a debian box based upon banners",
        "Taking a look at the website, has warnings about DOS type attacks.",
        "Discovering the /writeup/ directory in robots.txt",
        "Checking the HTML Source to see if there's any information about what generated this page.  Discover CMS Made Simple",
        "CMS Made Simple is an opensource product. Search through the source code to discover a way to identify version information.",
        "Using SearchSploit to find an exploit",
        "Running the exploit script with a bad URL and triggering the servers anti-DOS protection",
        "Running the exploit script with correct URL and analyze the HTTP Requests it makes via Wireshark to see how the SQL Injection works",
        "Explaining how password salts work",
        "Using Hashcat to crack a salted md5sum",
        "Demonstrating the --username flag in hashcat, this allows you to associate cracked passwords to users",
        "Begin of low-priv shell, running LinEnum to discover we are a member of staff"
      ]
    },
    {
      "name": "Ypuffy",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Want the WireShark Sticker? http://weirdstuffis.online",
        "Begin of Recon",
        "Enumerating OpenBSD Patch Date via SSH Version",
        "Examining port 80... Use Wireshark to see why NMAP gets a response but firefox does not",
        "Invalid Requests, will cause HTTP Service to send error message",
        "Using ldapsearch to enumerate ldap, use wireshark to see how the nmap script works",
        "Using SMBMap to PassTheHash and enumerate fileshares and download Putty Key",
        "Using PuttyGen to convert Putty Key to an RSA Key",
        "Testing out ssh_enumusers to see if that would have worked to get valid usernames",
        "Logged in as Alice, use LinEnum",
        "Examining doas configuration (like Sudo -l)",
        "Examining HTTPD Configuration to see why we couldn't hit the webserver earlier"
      ]
    },
    {
      "name": "Yummy",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Playing around with the website, booking a table and then registering an account",
        "Taking a look at the Save to iCalendar functionality and finding a File Disclosure vulnerability",
        "Finding the application source code via the /proc/self/cwd directory",
        "The JWT does RSA manually, using a weak exponent, showing we can factor this with RsaCtfTool",
        "Showing JWT.IO doesn't work with weak RSA Keys, showing an alternative tool",
        "Looking at cron jobs, finding all of the source code",
        "The DBMonitor Cron looks like it will execute code if we create specific files in the /data/scripts directory",
        "Using INTO OUTFILE with our SQL Injection to write files and exploit the DBMONITOR Cron to get a shell",
        "Shell returned looking at the database, then exploiting another cron because we can write a file",
        "Looking at the commit history of an Mercurial HG repo and finding a password"
      ]
    },
    {
      "name": "Zetta",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Begin of NMAP, then examining FTP to see the banner leak time and IPv6 compatibility.",
        "Running GoBuster so we always have recon running in the background",
        "Examining the Web Page to see it has some usernames and FTP Creds",
        "Logging into FTP and testing basic things like downloading/uploading files",
        "Ran out of things to test. Run NMAP on all ports, then look into things we don't know.",
        "Explaining what FXP is and what an FTP Bounce Attack is",
        "Performing the FTP Bounce Attack to get the IPv6 Address, then doing a nmap on the ipv6 address",
        "Identifying what port 8730 is (RSYNC) using both NMAP and NETCAT",
        "Downloading /etc via rsync, then explaining a bunch of configurations on the box",
        "Identifying there is an RSYNCD.SECRETS via the RSYNCD.CONF file.  Cannot download but can identify filesize which will tell us the number of characters the password is.",
        "Extracting all 8/9 character words out of RockYou.txt then using bash to script a rsync bruteforce (end of video we code a better brute force)",
        "Got Roy's password (computer),then downloading his directory to get user.txt.  After that upload an SSH Key"
      ]
    },
    {
      "name": "Zipper",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of NMAP",
        "Signing into Zabbix as Guest",
        "Getting potential usernames from inside Zabbix and guessing creds",
        "Running Searchsploit and looking for vulnerabilties",
        "Analyzing the \"API\" Script from SearchSploit as we have API Creds",
        "Modifying the \"API\" Script",
        "Showing a shortcut to skip the Container to Host Lateral Movement.",
        "Shell on the Container.",
        "Searching for Zabbix MySQL Password",
        "Dumping the Zabbix User Database",
        "Logging into Zabbix as Admin, discover ZBX Agent on Host.  Testing if port is accessible",
        "Running commands on the Zabbix Agent (Host OS) from Zabbix Server (Guest OS)"
      ]
    },
    {
      "name": "HackTheBox UniCTF 2022  Talk - Variable is what you make of It",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Hacking is an Art",
        "The \"Flow Chart\" Problem most People Make",
        "Keep is Simple, don't go straight to the reverse shell",
        "Ask Simple Questions, Start of Fuzzing",
        "Talking about ffuf and giving some demos",
        "Reading between the lines",
        "Importance of asking questions",
        "How to ask questions",
        "Keeping a positive mindset"
      ]
    }
  ],
  "uhc_machines": [
    {
      "name": "UHC - Altered",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Start of nmap",
        "Enumerating the web page, finding a way to validate potential users",
        "Examining the data the website stores in our browser",
        "Attempting type juggling, finding out its not vulnerable",
        "Before we WFUZZ, just playing with PHP to see how it handles numbers.",
        "Running WFUZZ with the range payload to bruteforce all possible pin code, find out we get blocked.",
        "Searching for ways to bypass rate limits, testing out the X-FORWARDED-FOR header",
        "Using WFUZZ with two wordlists in the zip mode, so we can fuzz with pin codes and change the ip address to bypass the ratelimit (FUZ2Z)",
        "Logged into the application, discovering the secret parameter which prevents us from tampering with the request",
        "Doing type juggling to bypass the tamper detection and finding SQL Injection",
        "Extracting information out of the database with union injections with group_concat and concat"
      ]
    },
    {
      "name": "UHC - Backend",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Introduction",
        "Start of nmap",
        "Examining the webpage, just finding json. Running gobuster to discover /docs and /api",
        "Examining the user and admin endpoint, showing /user/ has a 404 but we can go into it",
        "Talking about why API Discovery differs from normal web, instead of extensions we fuzz methods",
        "Using wfuzz to fuzz endpoints in /user/ with POST Requests to discover /login and /signup",
        "Fuzzing the signup endpoint, reading error messages to identify the fields it wants",
        "Showing that curl behaves differently. Lets troubleshoot this by sending our curl and burpsuite to wireshark and seeing why its behaving differently",
        "Attempting to login to the API with the credential we created, discovering we need a urlencoded request",
        "Logging in and getting a JWT Token, accessing /docs/ with it which is swagger documentation",
        "Authenticating in the swagger, so we can use the web interface to access private functions",
        "Changing administrators password with the UpdatePass endpoint, which is an IDOR like vulnerability"
      ]
    },
    {
      "name": "UHC - BackendTwo",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Talking about why dirbusting an API is different. Bruteforce methods instead of extensions and 404 doesn't terminate recursion",
        "Installing the latest version of FeroxBuster",
        "Running FeroxBuster with Force Recursion and multiple HTTP methods to discover user endpoints",
        "Downloading all users, creating a single json file, then using JQ to enable us to filter users",
        "Registering an account via the Signup endpoint. Analyzing errors to identify how it wants data",
        "Logging into the application in order to get a bearer token",
        "Using BurpSuite to add the Bearer Token to our HTTP Request and accessing /docs/",
        "Playing with the edit endpoint in the docs page",
        "Testing for Mass Assignment, by editing our profile but adding the is_superuser parameter",
        "Using the file endpoint to extract files from the application"
      ]
    },
    {
      "name": "UHC - Gobox",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Intro, box is playable on HackTheBox!",
        "Start of nmap and enumerating the page on port 80",
        "Discovering Port 8080",
        "Using ffuf to fuzz and discover SSTI",
        "Showing wfuzz doesn't need nearly as many parameters",
        "Reading up on GoLang SSTI",
        "Using GoLang {{ . }} to dump all variables and get password",
        "Logging in to get the Source Code and finding the DebugCmd Function",
        "Showing RCE through the GoLang SSTI",
        "The Docker is an internal docker, showing a bunch of hints towards AWS",
        "Using the aws commands to list buckets and upload a webshell via S3",
        "Getting a reverse shell"
      ]
    },
    {
      "name": "UHC - Jarmis",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Intro going over the attack chain, SSRF to Protocol Smuggling to OMIGod",
        "Using nmap and then checking out the website and adding the DNS Names to our host file",
        "Running GoBuster to discover the /docs directory, which is swagger documentation",
        "Reading the documentation and explaining JARM Signatures",
        "Explaining the front-end which just makes accessing the backend pretty",
        "Using Shodan to search JARM Hashes, which would be useful if you're looking for specific attack servers or collisions",
        "Dumping all the JARMS by abusing sequential ID's with a for loop and curl",
        "Whoops... Copied the wrong JARM, this was not cobalt strike lol.",
        "Running ncat with ssl, and checking if it is malicious... It's not malicious because the metadata was not there",
        "Using metasploit to show it would detect it as malicious",
        "Using IPTables to change the port on every 11th request with iptables -I PREROUTING -t NAT -p tcp --dport 443 -d 192.168.1.230 -m statistic --mode nth --every 11 --packet 10 -j REDIRECT --to-port  844",
        "Showing Gopher connecting to our ncat"
      ]
    },
    {
      "name": "UHC - LogForge",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap",
        "Discovering an Apache Tomcat Errror message despite the webserver being Apache",
        "Looking at Orange Tsai's 2018 Blackhat talk on Path Normalization",
        "Explaining the attack and how to bypass apache blocking access to /manager by using /..;/ or ;name=Stuff",
        "Attempting to deploy a WAR File to see that path is blocked by the max upload size being 1 byte",
        "Testing for log4j in Tomcat, discovering a callback",
        "Finding a twitter post that combines JNDI-Injection-Exploit-Kit and Ysoserial to do deserialization attacks with Log4shell/log4j",
        "Explaining whats different about ysoserial modified and why it lets us do reverse shells",
        "Running YsoSerial-Modified to generate a CommonsCollections5 payload",
        "Running JNDI Injeection Exploit Kit to setup the LDAP Server",
        "Running the exploit and getting a reverse shell, then looking at port 21 since it was filtered earlier"
      ]
    },
    {
      "name": "UHC - NodeBlog",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Box will be uploaded to HackTheBox by January 5th.",
        "Start of nmap",
        "Looking at the login, failing normal SQL Injection",
        "Start of talking about NoSQL/Mongo Injection",
        "Using the NE operator to create the NoSQL Injection where password is not equal to admin and bypassing login",
        "Showing the REGEX operator and talking about other ones to leak data",
        "Creating a python application to bruteforce passwords from the NoSQL Database one character at a time",
        "Script done, running it going over the code",
        "Examining the UPLOAD functionality of the site",
        "Testing for XXE",
        "Replacing our XXE POC to include a file. Then making the application error to get path of webapp, so we can extract source code"
      ]
    },
    {
      "name": "UHC - Pressed",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Running nmap, discovering wordpress",
        "Manually looking at the wordpress site, finding a post that has some dynamic content on it... This is weird",
        "Attempting to poison the browser table with php/ssti/etc user agents",
        "Starting wpscan with enumerating all plugins",
        "WPScan found a backup of the configuration file",
        "Changing the year on the password of the configuration file and discovering MFA",
        "Talking about the \"Discover Backup\" argument of gobuster, which does find another wp-config.php backup file",
        "Explaining what the XMLRPC Interface to wordpress",
        "Showing the system.listMethods function on the XMLRPC to list all the methods",
        "Switching over to the Python Wordpress XMLRPC Library to play with this interface, creating an object to login",
        "Showing how to dump users, then examine properties of a user"
      ]
    },
    {
      "name": "UHC - Ransom",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Start of nmap, getting distribution by googling SSH/HTTP Server headers",
        "Checking out the web page and discovering it is a Laravel PHP Application based upon the cookie",
        "Talking a little bit about Laravel Internals, and why our web request is going to the API Middleware is useful",
        "Showing that Laravel accepts data in the BODY even if it is a GET Request",
        "Changing our content type to JSON which will allow us to send JSON to the Laravel API",
        "Setting the password to the boolean true and bypassing login, explaining why === is important",
        "Logging into the application and discovering a zip file that is encrypted with ZipCrypto",
        "Showing where I got the inspiration for creating this challenge! An actual leaker made this mistake.",
        "Decrypting the zip with a known plaintext attack with bkcrack",
        "Logging into the box with the SSH Key",
        "Looking at the Laravel Source Code to find where the login function is and getting the root password for the box"
      ]
    },
    {
      "name": "UHC - Spooktrol",
      "os": "Linux",
      "difficulty": "Hard",
      "techniques": [
        "Intro Hacking a Command and Control Server",
        "Running nmap and discovering two different SSH Instances, guessing one is Docker",
        "Looking at robots.txt which includes a link to the implant, looking at the error message and discovering its a cpp binary",
        "Using Wireshark to discover it makes a DNS Request to Spooktrol.htb, then walking through the C2's handshake",
        "Using BurpSuite and socat to proxy the connection of our binary",
        "Using BurpSuites find and replace to edit the Task that is getting to our C2",
        "Opening up the binary in Ghidra",
        "Looking at the decompiled output for the main function, which calls Spooky.  Setting a break point on the XOR Function and discovering the first flag",
        "Discovering the Case Statement and analyzing Task number 1 (Exec)",
        "Stepping through each other task to discover what each function does",
        "The Perform Upload function builds a curl command",
        "Breaking after the curl string is assembled to show the full command it runs (Using BurpSuite to get to this part of the code)"
      ]
    },
    {
      "name": "UHC - Validation",
      "os": "Linux",
      "difficulty": "Easy",
      "techniques": [
        "Intro, sorry for double upload.  First one missed the last 5 minutes.",
        "Start of nmap, discovering SSH/HTTP are different operating systems",
        "Testing the website",
        "Intercepting the registration and testing for SQL Injection on the Country",
        "Discovering a static cookie is returned that is a MD5Sum of the UserName",
        "Our single quote country caused an Second Order SQL Injection testing Union Injection",
        "Using our Union Injection to drop a webshell",
        "Revrse Shell Returned",
        "Getting the database password out of the webconfig, and its also the root user",
        "Explaining how I gave \"dedicated\" containers to each player",
        "Going over the Kernel Module I wrote to do routing based upon the last octet of an IP Address",
        "Going over the code around SQL Injection and how to do prepared statements in PHP with SQL"
      ]
    },
    {
      "name": "UHC- Union",
      "os": "Linux",
      "difficulty": "Medium",
      "techniques": [
        "Intro the best box to practice SQL Union Injections but I may be bias",
        "Start of nmap discovering nginx with PHP",
        "Doing recon on the website",
        "Starting recon in the background GoBuster/SQLMap",
        "Manually examining the player submission page",
        "Manualling testing for SQL Injection, why its important to test with a query that returns data",
        "Testing for union injection, then pulling up MySQL Documentation and looking at the Information_Schema database",
        "Testing out the Union Injection by extracting a single database name",
        "Showing that we can return more than one row with the GROUP_CONCAT function",
        "Changing up the union to extract table and column information",
        "Prettying up the output by setting some delimiters with GROUP_CONCAT, then extracting data from the tables",
        "Submitting the flag and discovering our IP Address can now ssh into the box"
      ]
    }
  ],
  "vulnhub_machines": [
    {
      "name": "VulnHub - DC-9",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Explaining how networking is setup, then nmap",
        "Examining why nmap says a port is filtered in Wireshark",
        "Exploring the webpage and doing basic SQL Injections in the search functionality",
        "Starting GoBuster in the background, #AlwaysHaveReconRunning",
        "Explaining SQL Injection",
        "Explaining SQL Union Injection",
        "Testing Union Injection by doing \u201cUNION SELECT\u201d, then testing it by doing \u201cORDER BY\u201d.",
        "Explaining how to get data out of INFORMATION_SCHEMA",
        "Doing GROUP_CONCAT to extract multiple lines from a UNION Statement",
        "Using SED to replace \u201c,\u201d with line breaks and extracting a bunch of information out of the database",
        "Cracking the hash to see admin\u2019s password is transorbital1",
        "Using wfuzz to brute force a login prompt with two FUZZ Variables (some troubleshooting)"
      ]
    },
    {
      "name": "VulnHub - Pinkys Palace v2",
      "os": "",
      "difficulty": "",
      "techniques": [
        "https://www.vulnhub.com/entry/pinkys-palace-v2,229/",
        "Start of Recon, get debian rev from apache header.",
        "Explanation of NMAP Filtered // TCPWrapped",
        "Enumerating Wordpress",
        "Finding /secret folder with Port Knock Ports",
        "Trying to take advantage of open wordpress installer (Rabbit Hole)",
        "Writing port knock script",
        "Finally successful port knock, lets see what ports are open",
        "Using Cewl to build a wordlist, then using Hydra to bruteforce HTTP Post Login",
        "Login, ignoring an SSH Key :( and instead playing with an LFI!",
        "Reverse Shell via LFI + Log Poisoning",
        "Enough playing, lets crack SSH Key with John + sshng2john"
      ]
    },
    {
      "name": "VulnHub - Sokar",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of Recon (NetDiscover/Masscan/Nmap)",
        "Finding the CGI Script and using Shellshock",
        "Start creating ShellShock python script",
        "Converting script \"Forward Shell\" for FW Evasion with mkfifo",
        "Adding Threading (Background Task) to improve script",
        "Script completed - Attempt to enumerate FW Rules",
        "Fumbling around with IPv6 (Check out Sneaky Video for more)",
        "Reverse shell via IPv6 and ncat",
        "Reading Bynarr's mail to get password and PrivEsc via LIME/Memory Dum",
        "Unintended PrivEsc via ShellShock + Environment Variables",
        "Begin of MITM (Man in the Middle) First with Ettercap"
      ]
    },
    {
      "name": "Vulnhub - Trollcave 1.2",
      "os": "",
      "difficulty": "",
      "techniques": [
        "The CSRF Video I refer to is here: https://www.youtube.com/watch?v=d2nVDoVr0jE at 42m",
        "Start of Recon, nmap + dump web users",
        "Writing Python Program to dump uers.",
        "Dumping Users/Group done.  Now to dump PW Hints",
        "Python coding done.",
        "Examining the PW Reset Functionality, reset King (Unintended)",
        "Start of examining File Upload",
        "Finding local user + Exploiting File Upload",
        "Unintended Privilege Kernel Escalation (CVE-2017-16995)",
        "----- Box Done, Rest is extra content -----",
        "Stealing CoolDude89's Cookie to gain Moderator Access",
        "Playing with moderator function to promote user to Admin"
      ]
    }
  ],
  "sherlocks": [
    {
      "name": "Analyzing auth.log and Playing with Grok Filters - HTB Sherlocks - Brutus",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Going over the wtmp file, showing utmpdump and last",
        "Start of talking about the auth.log, grabbing all the programs (ssh, cron, etc) so we know what is in the log",
        "Question 1: Identify the bruteforce use grep with oP to extract all IP Addresses with login failures",
        "Question 2: Looking at successful logins and seeing the malicious IP logged into root",
        "Question 3: Looking at login/logoff times, getting the login time from wtmp as it is 1 second after the login",
        "Question 4: Grabbing the session number from logins which is part of systemd-logind",
        "Question 5: Finding the useradd line in the auth.log file",
        "Question 6: Looking at the MITRE Attack Framework and getting the ID-related to creating users for persistence",
        "Question 7: Using Last to look at how long a session was active for",
        "Question 8: Sudo is the only program  in auth.log showing commands being ran, looking at what was run",
        "BEYOND ROOT: Talking about how we can create grok filters to convert this log to json, we will use Go-Grok"
      ]
    },
    {
      "name": "Analyzing Event Logs and MFT Dump with Chainsaw - HTB Sherlocks - CrownJewel-1",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Download Chainsaw: https://github.com/WithSecureLabs/chainsaw00:00 - Introduction, going over the scenario talking about dumping NTDS and why its incredibly bad when an attacker does this",
        "Running chainsaw with the hunt operator, not getting much information",
        "Looking at what types of events were captured and using ChatGPT to give us event names for each ID",
        "Question 1: Looking at Event ID 7036 to see when Volume Shadow Copy Service entered a running state",
        "Showing how you could cheese the question by grepping for the word shadow",
        "Question 2: Looking at Event ID 4799 to see what groups VSSVC.EXE Enumerated",
        "Question 3: Getting the PID of VSSVC.EXE from the above log (event 4799)",
        "Question 4: Getting the GUID of the Volume Shadow Copy",
        "Question 5: Dumping the MFT Dump with Chainsaw and searching for ntds.dit to see where it exists on disk",
        "Question 6: Getting the timestamp the NTDS.DIT file was dumped",
        "Question 7: Searching the folder the NTDS.DIT was dumped to in order to find the other file that was dumped"
      ]
    },
    {
      "name": "Analyzing PCAP with Zeek - HTB Sherlocks - KnockKnock",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Going over the Scenario",
        "Talking about why I'm using Zeek and running it in a docker",
        "Showing a Corelight Zeek Cheat Sheet, which is tremendously helpful",
        "Showing Zeek-Cut on the x509 log, then looking at the SSL Log",
        "Looking for a single IP that sent multiple SSH Banners",
        "Creating an alias for zeek-grek (alias zeek-grep='grep -e \"^#\" -e'), which lets us easily filter logs",
        "Looking at the HTTP Log, discovering a wget downloading ransomware",
        "Looking at the FTP Log, and showing the passwords are hidden.  Editing the Zeek Config to unmask the password",
        "Editing the FTP Logged commands to add PASS so we see failed logins too",
        "Using the DNS Log to see that our attacker was likely using Amazon EC2",
        "Looking at how many connections each IP made, discovering our attacker doing a port scan using date -d @epoch to convert to human readable time",
        "Editing our zeek config to also extract_files, then looking at the ransomware download"
      ]
    },
    {
      "name": "Analyzing Sysmon From Backdoored UltraVNC Malware - HTB Sherlocks - Unit42",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Going over the Unit42 Research that was posted to GitHub",
        "Downloading Chainsaw which is what we will use to parse the eventlog",
        "Running the hunt operation with chainsaw and default sigma rules to see some suspicious events quickly",
        "Using the search functionality to show us events with the process guid to show us what the suspicious file did",
        "Question 1: How many event ID 11's are there, counting each Event ID",
        "Adding each Sysmon event name into our csv file",
        "Question 2: Identifying the malicious process, showing all process creation events and looking at what it does",
        "Question 3: Finding out how the malware was downloaded by looking at DNS Events and what process made them",
        "Question 4: Searching for file time stomping events to see the create time was set to an older time",
        "Question 5: Finding events related to once.cmd and seeing what created it",
        "Question 6: Looking at the DNS Queries for the malware to see the domain it uses to check if it has an internet connection"
      ]
    },
    {
      "name": "IR Employee Fell for a Call Center - HTB Sherlocks - Tick Tock",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Analyzing the files we have",
        "Using Impacket to dump local creds",
        "Running MFTECmd to process MFT File and Chainsaw to process logs. These take a while",
        "Looking at the Prefetch files to see what programs have been run",
        "Looking at the Teamviewer log file",
        "Looking at the Firefox History to see when they downloaded TeamViewer",
        "Looking at the Chainsaw hunt output... Probably not ideal since some logs didn't copy well.",
        "Going over Sysmon logs with JQ to search and filter",
        "Showing a trick with jq so we can grep entire events to avoid writing a select filter",
        "Looking at powershell, discovering some encoded commands which is where the bitlocker question is",
        "Using EvtxECmd to try parsing the logs, discovering the log was empty..."
      ]
    },
    {
      "name": "Log Analysis and Chainsaw Rule Creation - HTB Sherlocks - CrownJewel2",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Going over the Scenario",
        "Running Chainsaw Hunt to get an idea of whats in the log files, seeing  a Volume Shadow Copy Mount",
        "Running Hayabusa which is another tool that can analyze evtx files, it does a better job out of the box of showing malicious things",
        "Question 1: Looking at service start times to find when the latest time a Volume Shadow Copy started",
        "Question 2: Looking at the Full Path of the NTDS Dump File, when I say hunt found it was talking about Hayabusa's timeline",
        "Looking at how Chainsaw Rules Work so we can create a hunt rule on detecting NTDSUtil Dumping NTDS.DIT",
        "Creating the Chainsaw Rule",
        "Running the Chainsaw Hunt to detect the NTDSUtil Dumping NTDS.DIT",
        "Question 3 and 4: Finding when the dump started and finished",
        "Question 5: Getting the Event Source",
        "Question 6: Getting the groups NTDSUtil enumerated before running the dump"
      ]
    },
    {
      "name": "Post IR Investigation - MoveIT Exploit - HTB Sherlocks - I Like To",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Going over the questions",
        "Examing the forensic acquisition files",
        "Dumping the SAM Database to get hashes of the local accounts",
        "Running MFTECmd to convert the MFT (Master File Table) Dump to a JSON and CSV",
        "Analyzing the IIS Access Log",
        "Showing the files the attacker accessed in the Access Log",
        "Grabbing the Moveit metasploit script since the useragent hinted at metasploit being ran",
        "Using Chainsaw to convert the Security event log to JSON and hunt for suspicious events",
        "Analyzing the MFT JSON Output to discover when a file was written to disk",
        "Looking at the Powershell Console History to get what commands were ran",
        "Analyzing the Moveit MYSQL Dump file by copying it into a MySQL Server"
      ]
    }
  ],
  "tutorials": [
    {
      "name": "Advanced PHP Deserialization - Phar Files",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Previous Video: Intro to PHP Deserialization - https://youtu.be/HaW15aMzBUM",
        "Little bit of history about PHP Serialization",
        "Why is uploading Phar Files different than normal file upload vulns?",
        "What are Phar Files?",
        "Prevention by disabling the phar stream wrapper",
        "Going over the PHP Upload script created for this video",
        "Reviewing a PHP Script to generate malicious PHAR Files",
        "Setting our PHP Config to allow PHAR to operate in Read/Write mode",
        "Showing we can control the beginning bytes of the PHAR File to trick magic byte checks",
        "Copying the logging class from the intro to deserialization video into our upload script",
        "Adding the PHP Object/POP Chain to our PHAR Generation Script",
        "Starting a PHP Webserver so we can upload our image"
      ]
    },
    {
      "name": "Advanced Windows Logging - Finding What AV Missed",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Explaining the HELK Architecture",
        "Showing my VM's Spec's/build",
        "Installing HELK",
        "Poking around HELK's Logstash container to see how it works",
        "Examining HELK Elastalert to view sigma rules",
        "The magic behind catching APT! (sorry did it for the keywords)",
        "The SafetyKeyz Sigma rule, could easily be avoided",
        "Start of Windows",
        "Building a Sysmon Config with Sysmon-Modular",
        "- https://github.com/olafhartong/sysmon-modular",
        "Enabling Other Logging"
      ]
    },
    {
      "name": "All About DLL Hijacking - My Favorite Persistence Method",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Why DLL Hijack is my favorite persistence, talk about a few others",
        "Going over the source code to our sample applications to talk about DLL Hijacking",
        "Compiling our executable and dll then transfering it to our windows box",
        "Using Process Monitor to show standard DLL Hijacking (when a DLL Does not exist)",
        "Showing the order windows tries to load the DLL (Directory of binary then PATH)",
        "Talking about a somewhat common mistake when people make edits to the PATH (ex: Java/Python/etc)",
        "Placing the DLL test.exe is looking for and achieving code execution",
        "Showing if we can write in c:\\Windows, we can hijack most dll's explorer.exe loads from system32.",
        "Messing up using Process Monitor for a bit, sorry should have prepped a bit more",
        "Showing why explorer is unique, then putting CSCAPI.DLL into c:\\Windows\\... This would get ran anytime a user logs into the system",
        "DLL Hijacking OneDrive for user level persistence"
      ]
    },
    {
      "name": "AppLocker Bypass COR Profiler",
      "os": "",
      "difficulty": "",
      "techniques": [
        "This video didn't go quite as smooth as I expected.  Still putting it here to show an unintended route for Ethereal.  When I get more time, I'll probably redo this video, so don't be surprised if it d",
        "Demo of this AppLocker Bypass",
        "How this is different than LOLBINs",
        "Creating a Reverse Shell EXE",
        "Converting our Reverse Shell EXE to a DLL",
        "Performing this COR PROFILER bypass with our Reverse Shell DLL",
        "Trying to do this on the HackTheBox machine: Ethereal",
        "Creating a BAT file to set environment variables and execute TZSYNC",
        "Executing the BAT File and getting a meterpreter session!",
        "Doing JuicyPotato to privesc to SYSTEM",
        "Migrating to a user to be able to read an EFS Protected file."
      ]
    },
    {
      "name": "Attacking Password Resets with Host Header Injection",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction talking a little bit about",
        "Using Extension to show a legitimate password reset",
        "Modifying the host header and showing the website uses that in the sent email",
        "Talking about mail filters auto-clicking links, which means user interaction isn't always required",
        "Sending a password reset to one of my personal emails, to show a mail filter auto clicks the link",
        "Got our click! Checking the IP Address to show it was a bot",
        "Showing how easy this vulnerability can occur by having OpenAI Build us code!",
        "Verifying the code was indeed vulnerable",
        "Asking the AI ways to protect against this type of attack, the best way is to put a whitelist on valid domains used to generate password reset links",
        "Talking about the other ways to protect against this attack"
      ]
    },
    {
      "name": "Automating a File Disclosure Vulnerability to Crawl Website Source",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Check out https://snyk.co/ippsec",
        "Introduction",
        "Going over the file disclosure vulnerability we are using for the example (Zipping box from HTB)",
        "Showing the python script created in the file to exfil files one at a time",
        "Talking about why we created a file disclosure crawler, running it and opening VSCode",
        "Showing Snyk detecting vulnerabilities",
        "Going over the script we made on stream"
      ]
    },
    {
      "name": "Automating Boolean SQL Injection and Evading Filters",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Sign up for Snyk at https://snyk.co/ippsec",
        "Talking about why I like SQL Boolean Injection",
        "Opening up the source code to the web app",
        "Snyk sponsor segment, talking about how it can find and fix vulnerabilities in your code in real time",
        "Demonstrating validating boolean injection with an or statement",
        "Showing a small python client I made for this video to play with the SQL Injection, then showing subqueries",
        "Showing how to enumerate columns in the database via brute-force guessing because we can't use information_schema",
        "Going over the LIMIT statement so we can control which row we are looking at, then showing LIMIT 2 offset 1 is the same as LIMIT 1,1",
        "Showing the SUBSTR command so we can guess individual characters in a column/row",
        "Talking about converting a string to number in mysql which makes it possible to guess bad characters",
        "Start of creating our script, talking about the 3 functions we need, then creating one to dump the number of rows in a column",
        "Automating getting the length of a column in our row"
      ]
    },
    {
      "name": "AV Evasion - Mimikatz",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Installing FireEye Commando to help keep our development environments sync'd",
        "Using Git to download mimikatz, openifang with Visual Studio 2017 and installing dependencies",
        "Verifying that we can compile mimikatz before we make any changes.",
        "Creating an Antivirus Exception in Defender to ignore shared drive",
        "Remove String: mimikatz and then rename files with mimikatz in the name",
        "Remove String: all metadata by editing the RC File (accidentally wipe a quote)",
        "Replace Icon",
        "Test rebuilding after these changes.",
        "Using \"head\" to split the binary in half to help identify where Defender is identifying mimikatz",
        "Tons of splitting.",
        "Found a rough location of a bad string, opening in a hex editor to identify the string.",
        "Appears to flag on KiwiAndRegistryTools, lets verify"
      ]
    },
    {
      "name": "Basic Linux Memory Forensics - Dumping Memory and Files with DD - Analyzing Metttle/Meterpreter",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Discovering a weird binary running in /tmp/ but it doesn't exist on disk",
        "Start of explaining dd copying things out of memory",
        "Reading maps to identify where the file is, showing how to covnert hex to decimal in bash",
        "File extracted from memory",
        "Copying the heap from memory and discovering it is mettle/meterpreter based upon strings",
        "Showing we don't need to use DD to extract the file, can just use the \"exe\" file in proc/pid/",
        "Opening the elf in Ghidra and examining its decompiled output",
        "Showing what the file looks like in Cutter, which has a different decompile view",
        "Reading the Metasploit source code to identify what it looked like, to confirm what our findings from reversing",
        "Using MSFVenom to generate our own stager in order to confirm this is indeed what we saw on the box and that we extracted it correctly",
        "Using GDB against the stager to just practice reversing"
      ]
    },
    {
      "name": "Beyond Root - Crawling PHP Webapps After File Disclosure",
      "os": "",
      "difficulty": "",
      "techniques": [
        "In Zipper, we had a File Disclosure vulnerability.  In the video we had made it so we could manually specify files to extract. I want to have it automagically crawl the website extracting all the sour"
      ]
    },
    {
      "name": "Building Ippsec's Parrot VM - How to Run the Playbook.",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Github Repo: https://github.com/ippsec/parrot-build",
        "This is a quick video just to show how to run my Ansible Playbook to build out my Parrot VM. Check out the Building Parrot Playlist to see how this all works, so you can customize things to your likin"
      ]
    },
    {
      "name": "Camp CTF 2015 - Bitterman",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Using CheckSEC to explain the binary protections that can be applied.",
        "Running the binary to discover a segfault with long string of A's",
        "This is a 64 bit Binary so we overwrite RSP (Stack Pointer) not RIP (Instruction Pointer)",
        "Using Pattern Create to identify where we can overwrite RSP",
        "Using PwnTools to create a skeleton exploit",
        "Using objdump to dump the PLT (Procedural Link Address) and GOT (Global Offset Table) Address for PUTS so we can use ROP to write to the screen",
        "Using R2 (radare) to find the location to a pop rdi function",
        "Building the gadget chain to print the location of PUTS",
        "Packing the addresses in our exploit with p64(), then showing the leaked address",
        "Storing the leaked address as a variable so we can convert it to hex",
        "Memory address retrieved!  It changes every time the program loads, so adding a ROP back to MAIN"
      ]
    },
    {
      "name": "Combining AD Honey Pot Accounts with Canaries to Detect Password Sprays and Kerberoasting for free!",
      "os": "",
      "difficulty": "",
      "techniques": [
        "**IMPORTANT: The event filter should be 4625 not 4624.",
        "Going over CanaryTokens",
        "Scheduled Task Basics",
        "Switching over to Event Log",
        "Enabling logging for failures",
        "Searching Events based upon Event ID via XPATH/XML",
        "Searching Events based upon data in the Event Log",
        "Searching a specific field within the event log data",
        "Adding Boolean Logic to watch multiple events",
        "Preventing the account from being able to be used by setting login hours to none",
        "Creating a SPN so the account becomes kerberoastable"
      ]
    },
    {
      "name": "Configuring Burpsuite and Firefox via Ansible - Intro to Jinja2 and Ansible",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction talking about the power of Jinja2",
        "Quick Jinja2 introduction, showing how Ansible uses templates",
        "Using Jinja2 Loops with Ansible Variables to build URL's of Firefox Plugins and not put a comma on the last item.",
        "Showing how we can automate installing extensions in Firefox by editing the /usr/share/firefox-esr/distribution/policies.json",
        "Copying our test playbook of configuring Firefox into our main playbook as a role",
        "Showing a really good BurpSuite role, but we won't use this. I'd recommend you learn it",
        "Short rant on what I initially tried to do but gave up attempting (grabbing certificate out of userPrefs)",
        "Showing how the Ansible Plugin works, by starting BurpSuite in Headless mode, accepting the license then downloading off of Burps Website",
        "Struggling to get a shell script to download the Burp Certificate",
        "Playbook appears to work, but Burp was running from a previous test which made it work.  We fix this at 1:08:15",
        "Using our VSCode with Github Copilot to have AI Help us make playbooks",
        "Telling BurpSuite to only download the Certificate if it doesn't exist already"
      ]
    },
    {
      "name": "Configuring Iptables/UFW and Auditd with Ansible",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction why you should setup logging",
        "Start of configuring UFW, enabling UFW and setting the policy to accept all",
        "Showing how to insert IPTABLES Rules into UFW's Config",
        "Using the LineInFile Ansible Module to add our IPTABLES Line to Log SYN Packets on the INPUT Chain",
        "The IPTABLES Rule that logs all SYN Packets on INPUT",
        "Finding out rsyslog is disabled, enabling it",
        "Showing that we are now logging when boxes initiates a connection to us",
        "Moving our UFW Logging into our main playbook as a role",
        "Start of talking about AuditD",
        "Start of configuring the Playbook to install/configure AuditD",
        "Downloading auditd.rules from Florian Roth's github",
        "Showing ausearch that allows us to search through Audit Logs"
      ]
    },
    {
      "name": "Creating a VM to learn Linux PrivEsc",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Support the stream: https://streamlabs.com/ippsec"
      ]
    },
    {
      "name": "Creating Webhooks in Slack and sending messages from Powershell",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Simple concept/video but we will build more upon it in the following weeks.",
        "Signing up and installing the client",
        "Changing our channel to Private and Installing the Webhook",
        "Creating a PowerShell oneliner to send a message to slack",
        "Giving the message a little flair by changing the username and icon"
      ]
    },
    {
      "name": "Deep Dive into Parsing SSH Keys To Exploit Improperly Sanitized Screenshots",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Generating our SSH Key and Base64 Decoding it",
        "Opening the SSH Key in Bless",
        "Showing information from the SSH RFC which will tell us what we are parsing",
        "Start of parsing the SSH Key",
        "Opening an Encrypted Key and showing the slight changes",
        "Back to the unencrypted SSH Key and showing the private key does contain the private key",
        "Extracting the Exponent and N our of the Public Key portion",
        "Start of Private Key Information in the Private Key",
        "Extracting the variables from the Private Key Field",
        "Extracting Q, which is the big prime that we used in Response to rebuild the key",
        "Showing the comment which contains the username and hostname of the person that generated the key"
      ]
    },
    {
      "name": "Detecting Exploits - OMIGod (Linux Logging with Auditd)",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Intro, how to install and configure auditd",
        "Installing Auditd",
        "Downloading a good baseline ruleset from github",
        "Going over the baseline file to understand how logging works",
        "What the -p flag does with files. Logging read/write/execute/attribute change events",
        "If you want CWD in your logs, uncomment this line",
        "Logging priv_esc events",
        "Excluding system accounts from log captures",
        "Fun detections to find recon and suspicious activity",
        "Logging when users fail to access files in special directories",
        "Running the omigod exploit and getting a reverse shell echo/base64",
        "Running ausearch to detect what we had done by searching for commands ran by root"
      ]
    },
    {
      "name": "Detecting Responder via LLMNR Honey Tasks on User Workstations",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Talking about how the attack works and why NetBIOS/LLMNR should be disabled",
        "Running Responder on a linux host and then attempting to browse a file share on a Windows Host and grabbing the Hash",
        "Cracking the hashes our computer provided to show how easy it is to steal passwords on a network",
        "Showing how we can perform an LLMNR request in PowerShell",
        "Combining the Powershell LLMNR Request with our Slack WebMessage hook to send notifications to slack",
        "Testing the powershell code out and seeing it send a message to Slack",
        "Creating Scheduled Task to run this powershell code every 5 minutes",
        "Converting the powershell to powershell friendly (UTF-16LE) Base64",
        "Changing our scheduled task to write to EventLogs instead of Slack, which is better networks that have Centralized Logging",
        "Showing the schedueld task runs every 5 minutes."
      ]
    },
    {
      "name": "Device Code Login Phishing Presentation Attack, Detect, Mitigate",
      "os": "",
      "difficulty": "",
      "techniques": [
        "A couple weeks ago, I explored Device Code Phishing with a friend, and we decided to make a video about it. It's a new format of video and topic as I rarely cover the cloud, so we'd appreciate if you ",
        "- https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/",
        "- https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/",
        "- https://www.inversecos.com/2022/12/how-to-detect-malicious-oauth-device.html",
        "- https://0xboku.com/2021/07/12/ArtOfDeviceCodePhish.html",
        "- https://aadinternals.com/post/phishing/#new-phishing-technique-device-code-authentication",
        "- https://techcommunity.microsoft.com/blog/microsoft-entra-blog/new-microsoft-managed-policies-to-raise-your-identity-security-posture/4286758",
        "Showing the Storm-2372 Article",
        "Talking about phishing attacks starting out of band",
        "Bringing my friend on (oodie), slides talking about some good blog posts about this attack",
        "Talking about the history of the attack, when it began"
      ]
    },
    {
      "name": "DIY C2 - Malleable Agent Config",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Showing malleable c2 configs",
        "Creating a Hello World in C++ then creating a 2000 byte variable",
        "Adding JSON Support to our program",
        "Creating a Struct and function to initialize the config",
        "Having our main function parse the config",
        "Not sure what happened to my config.h, retyping it",
        "JSON Parsing done",
        "Creating a Python Program to replace the embedded config",
        "XOR'ing our config in python so we avoid strings",
        "XOR'ing in our agent to read the \"encrypted\" config",
        "Opening it up in Ghidra and doing some extremely light reversing"
      ]
    },
    {
      "name": "Dumping Data with NoSQL Injection via Regex and Python",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Check out Snyk here: https://snyk.co/ippsec",
        "Introduction talking about the application we are testing and identifying NoSQL Injection with $ne",
        "Showing the RegEx Operator, which will let us do partial matches and enable us to validate characters one at a time",
        "Start of sponsored shoutout to snyk",
        "Showing Snyk find some vulnerabilities with Open Source Security",
        "Showing Snyk's Code Security",
        "Showing and talking about how to patch the vulnerability",
        "End of Snyk Shoutout, starting our python script to perform this NoSQL Injection",
        "Testing out our test_login logic to identify if we had a successful login or not",
        "Showing how we can identify the length of the string we want",
        "Creating a loop to automatically identify the length of the string",
        "Adding exception handling to the function and talking about the benefits"
      ]
    },
    {
      "name": "Executing Linux Binaries Without Touching Disk - Living Off The Land with DDExec and Dirty Pipe Demo",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Intro, the stream is here: https://www.twitch.tv/videos/1445106911",
        "Start of the video, showing what is new about this technique",
        "Running through the example, showing we can change the filename in ps to anything we want",
        "Showing what this looks like in the ps output",
        "Explaining what I don't like about the example used on the website",
        "Explaining what process substitution is, which is a really good way to pass arguments to bash scripts when piping with curl",
        "Testing process substitution with ddexec locally",
        "Showing how to execute this with DirtyPipe",
        "Successful execution of DitryPipe",
        "Showing a dirtypipe that changes the root password, changing the default password it uses",
        "Showing we changed the password, and then trolling myself because this box has PAM_WORDLE installed",
        "Finding a DirtyPipe exploit that modifies a SetUID"
      ]
    },
    {
      "name": "Fixing Hashcat Flask Session Module  - Just Needed to Update Maximum Length of the Hash",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Recap, talking about the flask session cookie and showing hashcat won't crack ours",
        "Looking at Hashcat's source code, finding module 29100 which is flask session and seeing the max length is set to 27",
        "Checking out the JWT Module (16500) to see what the sizes are set there. Use this module because its similair.",
        "Downloading the source and compiling",
        "Testing the new version of hashcat and successfully cracking our Flask Session!",
        "Creating an issue/pull request on the Hashcat repo to get our change into the main repo."
      ]
    },
    {
      "name": "Golang for Hackers - LDAP Injector - Episode 04 - Functional Options Pattern",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Video currently in member only, will go free May 19th",
        "Introduction (mistakenly called this episode 3, when it is 4)",
        "Going over the code we are going to update",
        "Moving our options to an HttpOpts struct, then making a defaultOpt function",
        "Creating the Type Function Definition, that lets us store a slice of functions",
        "Creating the WithMethod function, that will return a function that modifies the HttpOption",
        "Using the Variadic Function to let us pass in our HTTP Options",
        "Creating a few more functions",
        "Adding the WithUrl,then deciding to pass it as a argument instead of an option",
        "Creating a function to check our options",
        "Using a map lookup instead of our Check Method function which is a little bit cleaner",
        "Copying our Functional Option Pattern to the Ldap Injector code"
      ]
    },
    {
      "name": "Golang For Hackers: LDAP Injector - Episode 01",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Episode 2 Dependency Injection: https://youtu.be/BhLpqRev80s",
        "Introduction",
        "Going over LDAP Injection, showing we can log in with a wild card for username and password",
        "Showing the request in BurpSuite, going over how we can enumerate data via Boolean Injection and wild card behavior",
        "Quickly going over Binary Search/Divide and Conquer, unfortunately, we cannot use it, but good to know for other Boolean Injections",
        "Start of creating our program, creating a TestPassword function, so we can replicate what we did in BurpSuite",
        "Creating a function that generates a lower alpha-numeric character set for us to use",
        "Starting the Bruteforce Logic, making a function that will bruteforce a single character",
        "Making the Bruteforce function, which will bruteforce each character of the password",
        "Talking about an optimization we can do and how many requests each method of bruteforce would do",
        "Creating the Prune Charset function, which will reduce our charset to only those that are in the password",
        "Going over each function, cleaning up some if/then statements"
      ]
    },
    {
      "name": "Golang For Hackers: LDAP Injector - Episode 02 - Dependency Injection",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Episode 1 - Creating the program: https://youtu.be/uJFW4c4QE0U",
        "Episode 3 - Error Handling: https://youtu.be/BhLpqRev80s",
        "Introduction",
        "Dependency Injection explanation with Python, showing why its important",
        "Start of adding Dependency Injection to our LDAP Injector, creating our NetHttpBrute Implementation",
        "Creating the interface and adding it to our LdapInjector object",
        "Updating the TestPassword method of LdapInjector to now be part of the NetHttpBrute Implementation",
        "Running the program now that we have separated our HTTP Client via dependency injection",
        "Moving the NetHttpBrute code into its own file, then having AI create us a file converting it to use FastHttp instead of the built-in NetHttp",
        "Creating a binary for both HttpBruteImpl and FastHttpBrute, then running them to see if there are any performance improvements"
      ]
    },
    {
      "name": "Golang for Hackers: LDAP Injector - Episode 03 - Error Handling",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Next episode: Functional Options Pattern - https://youtu.be/p4VqejsO6oU",
        "Introduction talking about error handling",
        "Quickly going over some python/golang code to show the difference in mindset",
        "Playing with a demo go application, using hard coded (or pre-declared) errors. Also called Sentinel Error usage",
        "Showing we could have done a Switch Statement instead of if/then",
        "Using the Custom Error Type Pattern, so it is a little bit more flexible",
        "Using Type Assertion, so we can access custom parts of our error message",
        "Start editing our LDAPInjector, so the Do function only returns error",
        "Updating the Do Function in NetHttpBrute",
        "Updating the TestCharacter Function",
        "Updating the Brute function",
        "Updating the PruneCharset function"
      ]
    },
    {
      "name": "HHC2016 - Ads",
      "os": "",
      "difficulty": "",
      "techniques": [
        "https://ippsec.github.io/holidayhack2016/part-4/#ad"
      ]
    },
    {
      "name": "HHC2016 - Analytics",
      "os": "",
      "difficulty": "",
      "techniques": [
        "https://ippsec.github.io/holidayhack2016/part-4/#analytics",
        "Note: Video may contain slight errors, most notably in this video is mistakenly saying \"Hash\" instead of \"Encrypt\" (ex: @5 minutes).",
        "A full text writeup can be found at:"
      ]
    },
    {
      "name": "HHC2016 - Debug",
      "os": "",
      "difficulty": "",
      "techniques": [
        "https://ippsec.github.io/holidayhack2016/part-4/#debug"
      ]
    },
    {
      "name": "HHC2016 - Dungeon",
      "os": "",
      "difficulty": "",
      "techniques": [
        "https://ippsec.github.io/holidayhack2016/part-4/#dungeon"
      ]
    },
    {
      "name": "HHC2016 - Exception",
      "os": "",
      "difficulty": "",
      "techniques": [
        "https://ippsec.github.io/holidayhack2016/part-4/#exception"
      ]
    },
    {
      "name": "HHC2016 - Getting Coins",
      "os": "",
      "difficulty": "",
      "techniques": [
        "https://ippsec.github.io/holidayhack2016/tokens/",
        "Note: Video may contain slight errors, most notably in this video is using \"function\" and \"variable\" interchangeably."
      ]
    },
    {
      "name": "HHC2016 - Terminal Speedrun",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Write Up Link:",
        "https://ippsec.github.io/holidayhack2016/part-3/"
      ]
    },
    {
      "name": "Hiding Spam with uBlock Origins",
      "os": "",
      "difficulty": "",
      "techniques": [
        "My uBlock Rule by the end of the video, definitely change the bad words:",
        "! Twitter Bad Words",
        "twitter.com##[data-testid=\"cellInnerDiv\"]:has-text(/ the | and | or /i)",
        "! Discover more / More Tweets - Conversation view suggestions",
        "twitter.com##[aria-label=\"Timeline: Conversation\"] [data-testid=\"cellInnerDiv\"] h2:has-text(/^(Discover more|More Tweets)$/):upward([data-testid=\"cellInnerDiv\"])",
        "twitter.com##[aria-label=\"Timeline: Conversation\"] [data-testid=\"cellInnerDiv\"] h2:has-text(/^(Discover more|More Tweets)$/):upward([data-testid=\"cellInnerDiv\"])~div",
        "The reddit post, not tweet lol: https://www.reddit.com/r/uBlockOrigin/comments/13twvuu/comment/jmg78ak/?utm_source=share&utm_medium=web2x&context=3",
        "Github Page: https://github.com/gorhill/uBlock/wiki/Dashboard:-My-filters",
        "Introduction talking about why I block it on the browser not platform.",
        "Creating the rule to hide tweets that contain words",
        "Discovering we didn't filter words, but strings. So \"the\" would block \"therefore\", since the is a substring.",
        "Making it case insensitive"
      ]
    },
    {
      "name": "How To Create Empire Modules",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Testing out a new microphone, enjoy the random video.",
        "Downloading Empire + PowerShell Port Forward",
        "Explaining Empire Directory Structure",
        "Copying the PowerShell Template (Empire Module) to a working directory",
        "Creating the Empire Module",
        "Converting PowerShell Port Forward Script to an Empire Friendly Format",
        "Starting Empire",
        "Empire Agent Active",
        "Checking if the module worked.  It did not, begin troubleshooting!",
        "Found the Error! Huzzah!",
        "Reloading the module",
        "Executing the module again, this time it works."
      ]
    },
    {
      "name": "Installing VSCode with Copilot and Snyk via Ansible",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Sponsor Link: https://snyk.co/ippsec",
        "Repo Here: https://github.com/IppSec/parrot-build",
        "Introduction Promoting Snyk",
        "Showing why we are using VSCode and not Codium",
        "Showing Ansible Galaxy, which are community provided roles. Specifically the Visual Studio Code one and creating requirements.yml",
        "Adding the Visual Studio Code role to our playbook and installing a couple extensions",
        "Going to the Visual Studio Code Marketplace and showing how we get extension names to add to our playbook, then running our playbook",
        "Opening VS Code and Signing in to Copilot, then showing it do some predictive typing with python",
        "Showing Autopilot works with Ansible Playbooks",
        "Downloading the web application on TwoMillion, so we can use Snyk to analyze it",
        "Installing the Snyk VSCode Plugin",
        "Opening VS Code and authenticating with Snyk"
      ]
    },
    {
      "name": "Intercepting Android App Traffic with BurpSuite",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction, talking about RouterSpace and why we can't just do what we did in that video",
        "Installing Genymotion, Virtual Box, and ADB; while talking about why I don't use Android Studio/AVD. Simply because genymotion just works.",
        "Make sure you upgrade your memory, processors, and enable Virtualization in your VM Settings!",
        "Running Genymotion and starting a Pixel 3 XL",
        "Converting BurpSuites Certificate to PEM Format with openssl x509 -inform der -in [name of cert] -out burp.pem",
        "Renaming the certificate to 9a5ba575.0, and showing how we got that name",
        "Starting the device and showing the certificate authorities",
        "Copying the certificate to /system/etc/security/cacerts/, and showing how to remount to rw",
        "Showing how to set the proxy through both the GUI and via ADB",
        "Installing GAPPS",
        "Showing how to unset the proxy from ADB",
        "Creating an alias to set and unset the proxy via adb"
      ]
    },
    {
      "name": "Intro to PHP Deserialization / Object Injection",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Background information, showing variables are point in time",
        "Creating a PHP Class and Object",
        "Serializing the Object and going over the format",
        "Converting the script to accept a PHP Object via WebRequest",
        "Explaining PHP Desesrialization Gadgets",
        "Creating Attack.php in order to quickly generate PHP Objects",
        "Creating exploit.sh which will just send our malicious object to the webserver",
        "Going over PHP Magic Methods",
        "Adding the __toString class that we can create a gadget to get to in order to read files",
        "Adding the new class to our attack script and reading /etc/passwd",
        "Demonstrating \"Class Path\" by creating an __destruct() method in another php file and including it",
        "Adding the LogFile to our class path and using it to drop a file"
      ]
    },
    {
      "name": "Introduction to tmux",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Why I like Tmux",
        "Creating Tmux Session",
        "Bash: Ctrl + R - Recursive Search",
        "Tmux: Prefix Key (default Ctrl+B)",
        "Tmux: New Window - Prefix c",
        "Tmux: Switch Window - Prefix #",
        "My Tmux Config",
        "Demo of \"nested tmux\"",
        "Tmux: Rename Window - Prefix ,",
        "Tmux: Send/Join Pane Prefix [s|j]",
        "Tmux: Setting Search to Vi mode",
        "Tmux: Enter edit mode Ctrl+["
      ]
    },
    {
      "name": "Ippsec's Thoughts on the New Hack The Box Seasons",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Feedback: https://orrsuc93j02.typeform.com/HTBSEASONS",
        "Sorry for the bad cam quality.  Screwed up recording, then was too lazy to re-record.",
        "Introduction why you should play NOW",
        "Going over the blog, what we mean by Beta Season",
        "How many points each machine is worth",
        "Talking about Tiers AKA the completion based rewards",
        "Talking about the prizes",
        "Talking about Academy Modules",
        "Talking about the competitive rewards",
        "Connecting to the Seasonal Machine",
        "How to give feeback."
      ]
    },
    {
      "name": "Ippsecs First Look and Setting up CrowdSec  - Stealthfully Forward Malicious Users to Honeypots",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Intro talking about crowdsec and its multiplayer firewall",
        "Showing my setup, 3 web servers, 2 attack servers",
        "Installing Crowdsec",
        "Going over the command line interface, CSCLI showing decisions",
        "Showing descisions -a to go over every CrowdSec ban list",
        "Attacking the webserver, showing it detect the SSH Brute Force",
        "Installing the CrowdSec Bouncer, then showing the attack box is now blocked",
        "Using iptables and ipset to show how CrowdSec Blocks things (with iptables)",
        "Looking at Collections and Scenarios to see how CrowdSec works",
        "Looking at the CrowdSec documentation to understand the inner workings",
        "Showing Crowdsec would block us for using GoBuster",
        "Installing the dashboard to see the fancy graphical reporting from CrowdSec"
      ]
    },
    {
      "name": "Looking into the Looney Tunable Linux Privesc CVE-2023-4911",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction talking about what the Looney Tunable exploit is and my thoughts on the severity of the exploit",
        "Start talking about how the vulnerability works",
        "The POC String to identify if a box is vulnerable, it doesn't actually exploit but quickly identifies if a vulnerable glibc is installed",
        "Important parts I wanted to point out in the technical writeup.",
        "Downloading a good POC written in python, then glancing over the code to make sure there isn't anything malicious",
        "Analyzing the exit shellcode manually in Ghidra to see it just exits with 0x66",
        "Analyzing the main shellcode in Ghidra, showing it does a lot more",
        "Putting the Shellcode into an elf binary, so we can analyze it with gdb",
        "Logging into HTB's TwoMillion machine to run this exploit",
        "Showing how to get the magic numbers incase your target is not supported. Disable ASLR then running the exploit",
        "Looking at how Elastic got lucky and detected this exploit with their default ruleset",
        "Looking at how CrowdSec detects it"
      ]
    },
    {
      "name": "Making Blind XXE Quicker and Easier By Creating a Script to Exfiltrate Files",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction, why I created this script and a quick demo",
        "Going over XML Entity Injection, doing it manually and explaining what the payloads are",
        "Sponsor shoutout, showing Snyk scan the source code to this application and catching the XXE",
        "Patching the code, asking Github Copilot for a proper way to fix it and it recommends disabling loading XML Entity off remote sources",
        "Making sure Snyk is happy with our code fix and going over some other findings",
        "Start of coding the XXE Script, creating the webserver",
        "Putting our webserver in a thread so we can also run a CLI",
        "Talking about how and why we are just going to use a global variable with our thread",
        "Having our terminal able to update the payload variable, so we can easily change files we want to exfil",
        "Creating a function to read an HTTP Request copied from Burp, so we can use it with python requests",
        "Testing out our function, and discovering we need to fix the path",
        "The skeleton of the script is done, adding in the logic to actually perform the XXE Attack but putting the file name in the wrong spot."
      ]
    },
    {
      "name": "Manually Parse Bloodhound Data with JQ to Create Lists of Potentially Vulnerable Users and Computers",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Intro talking about why we want to parse Bloodhound Data with JQ to create lists",
        "Just examining the data in Bloodhound",
        "Writing a Cipher Query to show all enabled users in Bloodhound",
        "Showing Bloodhound Debug Mode which will show Cipher Queries when you run them",
        "Start of looking at Bloodhound Data",
        "Digging through the JSON Structure with JQ to get to the Properties of a User",
        "Showing all the names, if we wanted to remove the quotes, we could use the -r flag for raw",
        "Using the Select Query in JQ to show only enabled/disabled users",
        "Outputting multiple fields in JQ so we can show usernames + descriptions",
        "Using JQ to filter out descriptions with null to only show AD Accounts with a description",
        "Talking about LastLogon and LastLogonTimeStamp",
        "Converting integers to string in JQ so we can output them"
      ]
    },
    {
      "name": "Monitoring Sensitive Windows Commands via CanaryTokens - Deploying Registry Entries via Group Policy",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Intro, you should be using centralized logging for this. But if not this hackjob will do",
        "Talking about the Sensitve Command Token",
        "Examining how this all works, creates three registry keys for Image File Execution Options and SilentProcessExit",
        "Talking about the \"So much offense in my defense\" phrase. Really loved it, showing a blog about using this technique as a persistence",
        "Showing the token works and what the email looked like",
        "Ranting more about \"so much offense in my defense\" and why blue teamers should learn red team techniques",
        "Creating a new token so we can deploy this one via Active Directories Group Policy",
        "Opening GPMC and creating a registry entry",
        "Running gpupdate /force to show the group policy created the registry keys",
        "Attempting to get the arguments of our process but failing. Never get this part working.",
        "Referenced Blogs:",
        "https://blog.thinkst.com/2022/09/sensitive-command-token-so-much-offense.html"
      ]
    },
    {
      "name": "PHP Type Juggling - Why === is Important - Bug Bounty Tips",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Join Intigriti here: https://go.intigriti.com/ippsec",
        "Enumerating the application utilizes Laravel based upon a default cookie name.",
        "Jumping into a PHP Interpreter to show off the Type confusion bug.",
        "Trying the same thing in Python, Javascript, Ruby, and showing that they aren't vulnerable in this way.",
        "Talking about the importance of the Laravel API Middleware",
        "Converting the GET request to have JSON Data",
        "Changing the JSON Data to pass a boolean for password",
        "Bypassing login with type confusion",
        "Sponsor highlight Intigriti",
        "End of sponsor highlight",
        "Looking at the Laravel Code to find where the route is for the custom login function"
      ]
    },
    {
      "name": "Playing with Exploits - OMIGod",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Start of installing OMI Locally",
        "Downloading the exploit, but get a connection error because it cannot talk to OMI",
        "Editing the OMI Configuration to set it to listen on 5986",
        "The exploit still isn't working debugging to find it is missing a namespace",
        "Finding the SCX Package Name and using a Index.Of Google Dork to find it on an open HTTP directory",
        "Installing the SCX Agent and getting code execution",
        "Setting the exploit to go through BurpSuite so we can understand how it works",
        "Going over the blog post to understand why it was vulnerable",
        "Talking about how the researchers may have found it.  MS Patched it without major announcement and it was in the Git Changelog!"
      ]
    },
    {
      "name": "PowerSIEM - Analyzing Sysmon Events with PowerShell - Dynamic Malware Analysis",
      "os": "",
      "difficulty": "",
      "techniques": [
        "PowerSiem: https://github.com/IppSec/PowerSiem",
        "Creating PowerSiem: https://www.twitch.tv/videos/1438252177",
        "Sysmon: https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon",
        "Sysmon Configuration File: https://github.com/Neo23x0/sysmon-config",
        "Talking about PowerSIEM",
        "Installing Sysmon with Florian Roth's default config",
        "Showing what PowerSIEM does by running it and opening a command prompt, browser, etc",
        "Explaining the PowerSIEM Script, how it works, and all the current sysmon events",
        "Setting breakpoints in Powershell ISE",
        "Adding data to the Registry Set event",
        "Showing just running a SysInternals tool creates a registry key for accepting the EULA"
      ]
    },
    {
      "name": "Rebuilding Parrot and Using Ansible to Script Customizations to My Image",
      "os": "",
      "difficulty": "",
      "techniques": [
        "The Github Repo: https://github.com/IppSec/parrot-build",
        "Intro downloading the HTB Edition of Parrot and talking about basic VM Things",
        "Talking about using Ansible to install software after and why we should not use Snapshot's for a long-term solution.",
        "Parrot has been installed! Fixing up the Terminal real quick and talking about how to set the prompt like I have it",
        "Installing Ansible with apt",
        "Creating our first playbook, doing some quick introduction things",
        "Creating an Ansible Role to configure tmux",
        "Looking at all the ansible_facts to see the variable where our home is stored",
        "Using the copy module in ansible to copy files to our users home directory",
        "Start creating an ansible role for customizing our terminal",
        "Looking at how Mate Terminal creates profiles and exporting our settings so ansible can load it. Lots of using dconf",
        "Using Ansible to start configuring mate terminal"
      ]
    },
    {
      "name": "Reversing Malicious Office Document (Macro) Emotet(?)",
      "os": "",
      "difficulty": "",
      "techniques": [
        "OLEVBA - https://github.com/decalage2/oletools/wiki/olevba",
        "Extract Macro with olevba",
        "ExifTool to examine Document Metadata (Comments used in Macro)",
        "Examining Macro Code",
        "Using Python to explan Right(left))",
        "Opening ProcMon",
        "Why you should be careful when executing portions of \"bad code\"",
        "Viewing Macro's in Word and DeObfuscating by changing Shell to Print",
        "Start of Obfuscated Powershell (after de-base64)",
        "Malicious Powershell Code",
        "Upload to VirusTotal",
        "Looking at process explorer"
      ]
    },
    {
      "name": "Reversing Malware How is APT 29 Successful w/ this Phishing Tech and BRc4 (Brute Ratel) opsec fails?",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction, talking about why I think APT-29 successfully phishing is funny",
        "Unit42's blog post talking about how the phishing document worked",
        "Going to google to show APT29 doing the lnk file in a zip since atleast 2016, Mandiant post.",
        "Talking about why phishers put executables or things to click on in zip/iso/compressed folders",
        "Talking about why they may use DLL Side Loading to execute the shellcode",
        "Showing what the user see's when they open the iso file",
        "Talking about why we are starting with shellcode instead of a weaponized document and why red teams like shellcode",
        "Using MSFVenom to generate a malicious executable with custom shellcode from BRc4",
        "Opening the executable with x64dbg, so we can extract a program from memory. This is great for when the shellcode is obfuscated through like shikata ga nai",
        "Setting a breakpoint on LdrLoadDll, showing the memory map is empty",
        "Running the program, examining memory on LdrLoadDll breakpoint.  Showing a weird Execute-Read Permission, which initially was Read-write (screwed up initially explaining it)",
        "The E_MAGIC (MZ Header) is nulled out, talking about why the brute ratel may do that"
      ]
    },
    {
      "name": "Securing Vendor Webapps - A Vulnerability Assessment on HELK",
      "os": "",
      "difficulty": "",
      "techniques": [
        "More detailed notes: https://gist.github.com/IppSec/137a9f8870bed2763048072f321073e5",
        "My Vulnerability Assessment methodology",
        "Starting a Nessus Scan to see what it thinks",
        "Running nmap and deciding what ports are needed",
        "Reviewing the Nessus Scan",
        "Examining what leaving KSQL/Kafka (8088) open can do",
        "Using iptables to block ports that don't need to be routable",
        "Preventing NMAP from detecting the port as filtered, doing REJECT --reject-with tcp-reset",
        "Using Draw.io to explain what we are doing with a Reverse Proxy",
        "Installing Apache2",
        "Creating the reverse proxy HTTPS Configuration, then enabling modules ssl, proxy, proxy_http",
        "Our Apache Server doesn't like self-signed certificate of remote server adding:"
      ]
    },
    {
      "name": "Setting Up Elastic 8 with Kibana, Fleet, Endpoint Security, and Windows Log Collection",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Intro brief descriptions of Elastic, Kibana, Fleet Management, Endpoint Security, Windows Logging",
        "Logging into our Elastic Box and going to https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elastic-stack-on-ubuntu-22-04",
        "Changing the Elastic Repo from 7.x to 8.x, then installing Elastic making sure to grab the default credentials",
        "Making sure our Elastic Database is online with Curl",
        "Installing Kibana",
        "Generating an enrollment token for Kibana, adding it to the config and starting Kibana",
        "Installing NGINX to put in front of Kibana",
        "Logging into Kibana and setting up the Fleet Integration so we can manage agents",
        "Copying the Elastic CA Certificate over the fleet, just to make some of our certificates easier",
        "Installing fleet but adding the --fleet-server-es-ca and --insecure flags",
        "Installing the Fleet Agent on our windows box",
        "Adding the Endpoint and Cloud Security Integration, which has a lot of good alerts for detecting bad things"
      ]
    },
    {
      "name": "SQL Injecting Beyond Strict Filters - Union Without Comma",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Introduction",
        "Showing the trick and explaining why its important to understand the methodology behind finding the technique and not just the technique itself",
        "Going over the Flask App",
        "Showing Snyk highlighting the SQL Injection, then talking a little bit about Snyk and why it is awesome.",
        "Running the webserver and explaining why DEBUG mode should always be disabled",
        "Running SQLMap to inject into the URL Parameter",
        "Manually discovering the SQL Injection through good enumeration, and showing a Burpsuite URL Encoding Quirk",
        "SQLMap showed nothing, Run SQLMap again but this time make sure it starts with a valid result to see it does find something",
        "Going into the code to show why exploitation is hard, I'm using Pydantic to do strict typing and input filtering",
        "Showing how SQLMap discovered there were 4 columns without using a comma, thanks to the ORDER BY method",
        "Enumerating for bad characters with FFUF by putting characters after the SQL Comment",
        "Showing SQLFiddle, which is a great way to play and test SQL Queries"
      ]
    },
    {
      "name": "Sunday Night Learning",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Unofficial Time Schedule.",
        "- First 30 minutes - Using ansible to build a Windows Domain",
        "- Next 30-45 minutes - Searching Exploit-DB and taking apart exploits to understand them",
        "- The remainder of time - VulnHub or something."
      ]
    },
    {
      "name": "Troubleshooting failed RCE Payloads by Debugging Python Web Applications  - Noter Beyond Root",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Copying the webapp from the server to my local box",
        "Intalling the required modules to run the pip modules and running the website locally",
        "Using SSH Port forwarding to forward MySQL, so we don't have to setup a database",
        "Changing localhost in the web code to 127.0.0.1 which magically fixes an issue we had connecting to the database",
        "Getting an administrative login, registering a new user and then updating their role",
        "Running Visual Studio Code which gives us a nice debugger",
        "Creating a test payload and seeing why it fails",
        "Going over what $'' is and why it prevented our command execution if we didn't escape it",
        "When sending over the single quote, it is html encoded. Editing variables in the debugger to make sure if we bypass this stage we would have command execution",
        "Intercepting the request in BurpSuite and discovering the HTML Encoding is done client side, by editing the request we can get RCE!"
      ]
    },
    {
      "name": "Using PAM EXEC to Log Passwords on Linux",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Video will be public June 2nd",
        "Introduction",
        "Talking about what PAM is",
        "Talking about pam_exec",
        "Creating a bash script pam_exec calls to log passwords",
        "Creating a GoLang binary that replicates our Bash Script to log passwords",
        "First iteration almost done, dumping all passwords",
        "Explaining how we will add if the authentication was successful in our log file",
        "Replacing the last line in the log file, probably wrong about runes here but yolo",
        "Modification complete! Showing our logger works and dumps all the passwords"
      ]
    },
    {
      "name": "Using Sysmon to Block Unwanted Files and Send Notifications to Slack via Scheduled Task Event Filter",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Installing Sysmon and the configuration from Neo23x0's Repo",
        "Explaining the file blocked section",
        "Viewing the Sysmon log to confirm it is installed and see its EvendID 27",
        "Creating a Scheduled Task with Event Filter to trigger on Sysmon File Blocked Events",
        "Event did fire turns out it is case sensitive",
        "Editing the Scheduled Task event by hand to add ValueQueries which allows arguments to be sent from this Event Filter",
        "Testing the passing of variables by adding them to the message box",
        "Start of creating some powershell to send this message to Slack",
        "Have trouble getting arguments into the powershell script because of Base64 Endcoding, change up our script",
        "Showing a working copy of the powershell script that sends slack messages",
        "Deploying our scheduled task through Group Policy"
      ]
    }
  ],
  "academy_modules": [
    {
      "name": "Academy: Active Directory BloodHound",
      "os": "",
      "difficulty": "",
      "techniques": [
        "HackTheBox Course on using Bloodhound, including writing cypher queries for custom graphs!  This cost 500 cubes, which is $50"
      ]
    },
    {
      "name": "Academy: Active Directory LDAP",
      "os": "",
      "difficulty": "",
      "techniques": [
        "HackTheBox Course on Enumerating Active Directory over LDAP.  This cost 1000 cubes, which is ~$100"
      ]
    },
    {
      "name": "Academy: Active Directory PowerView",
      "os": "",
      "difficulty": "",
      "techniques": [
        "HackTheBox course on Active Directory Enumeration and Exploitation with PowerView.  This cost 1000 cubes, which is $100"
      ]
    },
    {
      "name": "Academy: Attacking Web Applications with FFUF",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Free HackTheBox Course on using FFUF"
      ]
    },
    {
      "name": "Academy: Cracking Passwords with Hashcat",
      "os": "",
      "difficulty": "",
      "techniques": [
        "HackTheBox Course on using Hashcat to its fullest.  This cost 100 cubes, which is ~$10"
      ]
    },
    {
      "name": "Academy: File Inclusion / Directory Traversal",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Free HackTheBox Course on performing Directory Traversal and File Inclusion attacks"
      ]
    },
    {
      "name": "Academy: Hacking Wordpress",
      "os": "",
      "difficulty": "",
      "techniques": [
        "HackTheBox Course on Hacking Wordpress.  This cost 100 cubes, which is ~$10"
      ]
    },
    {
      "name": "Academy: Intro to Academy",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Free HackTheBox Course on using the Academy Platform"
      ]
    },
    {
      "name": "Academy: Javascript Deobfuscation",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Free HackTheBox Course on Deobfuscating Javascript"
      ]
    },
    {
      "name": "Academy: Learning Process",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Free HackTheBox Course on getting into the right mindset to learn."
      ]
    },
    {
      "name": "Academy: Linux Privilege Escalation",
      "os": "",
      "difficulty": "",
      "techniques": [
        "HackTheBox Course on Linux Privilege Escalation.  This cost 500 cubes, which is ~$50"
      ]
    },
    {
      "name": "Academy: Login Brute Forcing",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Free HackTheBox course on bruteforcing common logins"
      ]
    },
    {
      "name": "Academy: Network Enumeration with Nmap",
      "os": "",
      "difficulty": "",
      "techniques": [
        "HackTheBox Course on using NMAP to its fullest.  This cost 50 cubes, which is ~$5"
      ]
    },
    {
      "name": "Academy: Secure Coding 101: Javascript",
      "os": "",
      "difficulty": "",
      "techniques": [
        "HackTheBox Course on Javascript Coding.  This cost 1000 cubes, which is ~$100"
      ]
    },
    {
      "name": "Academy: Web Requests",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Free HackTheBox Course about HTTP or Web Requests"
      ]
    },
    {
      "name": "Academy: Whitebox Pentesting 101: Command Injection",
      "os": "",
      "difficulty": "",
      "techniques": [
        "HackTheBox Course on Command Injection Vulnerabilities.  This cost 500 cubes, which is ~$50"
      ]
    },
    {
      "name": "Academy: Windows Fundamentals",
      "os": "",
      "difficulty": "",
      "techniques": [
        "Free HackTheBox Introductory Course on Windows"
      ]
    }
  ],
  "ippsec_tools": [
    {
      "name": "forward-shell",
      "url": "https://github.com/IppSec/forward-shell",
      "stars": 166,
      "description": "Forward shell for firewall evasion - sends exploits through mkfifo named pipes. Originally built for Shellshock exploitation."
    },
    {
      "name": "evil-cups",
      "url": "https://github.com/IppSec/evil-cups",
      "stars": 43,
      "description": "CUPS exploitation tool for CVE-2024-47076/47175/47176/47177. IppSec authored the EvilCUPS HTB machine around this."
    },
    {
      "name": "parrot-build",
      "url": "https://github.com/IppSec/parrot-build",
      "stars": 234,
      "description": "Ansible playbooks to automate building IppSec's Parrot OS pentesting VM. Configures tools, Firefox, BurpSuite, iptables, etc."
    },
    {
      "name": "PowerSiem",
      "url": "https://github.com/IppSec/PowerSiem",
      "stars": 126,
      "description": "PowerShell SIEM for analyzing Sysmon events. Dynamic malware analysis tool."
    },
    {
      "name": "ippsec.rocks (ippsec.github.io)",
      "url": "https://github.com/IppSec/ippsec.github.io",
      "stars": 153,
      "description": "Searchable index of all IppSec YouTube videos. Search by technique, tool, machine name, etc."
    },
    {
      "name": "Jarmis",
      "url": "https://github.com/IppSec/Jarmis",
      "stars": 8,
      "description": "JARM signature analysis tool used in UHC Jarmis machine."
    },
    {
      "name": "ctf-scripts",
      "url": "https://github.com/IppSec/ctf-scripts",
      "stars": 21,
      "description": "Collection of scripts created during CTF competitions."
    }
  ]
}