https://blog.hackersonsteroids.org/Hack The Box and HackingClub writeups, CVE proof of concepts, tooling and blue team notes from hackersOnSteroids, a Brazilian offensive security team. 2026-11-09T17:07:49+00:00 hackersOnSteroids https://blog.hackersonsteroids.org/ Jekyll © 2026 hackersOnSteroids https://blog.hackersonsteroids.org/assets/img/favicons/favicon.ico https://blog.hackersonsteroids.org/assets/img/favicons/favicon-96x96.png 2026-11-09T16:52:00+00:00 2026-11-09T16:52:00+00:00 https://blog.hackersonsteroids.org/posts/htb-handler/ admin

HTB Handler: Season 12 week 9, an insane Windows box by 0xEr3bus, out 2026-11-21 at 19:00 UTC. Starts with given creds. What we know and how to prep.

2026-11-09T16:50:00+00:00 2026-11-09T16:50:00+00:00 https://blog.hackersonsteroids.org/posts/htb-redeye/ admin

HTB RedEye: Season 12 week 8, a hard Windows box by 0xEr3bus and Pho3o, out 2026-11-14 at 19:00 UTC. What we know before release and how to prep.

2026-10-28T18:40:00+00:00 2026-11-09T16:56:28+00:00 https://blog.hackersonsteroids.org/posts/htb-unclaimed/ admin

HTB Unclaimed: Season 12 week 7, a medium Windows box by amra13579. 3.2/5 from 88 reviews, 1,486 user owns in two days. Live stats and prep, spoiler-free.

2026-10-28T18:30:00+00:00 2026-11-09T16:56:28+00:00 https://blog.hackersonsteroids.org/posts/htb-takeoff/ admin

HTB Takeoff: Season 12 week 6, a hard Linux box by ctrlzero. 4.5/5 from 127 reviews, 2,243 user owns in nine days. Live stats and prep, spoiler-free.

2026-10-28T18:20:00+00:00 2026-11-09T17:07:19+00:00 https://blog.hackersonsteroids.org/posts/htb-dutybound/ admin

HTB DutyBound: Season 12 week 5, a medium Linux box by Pho3o. 3.6/5 from 122 reviews, 1,908 user owns in four days. Live stats and prep, spoiler-free.

2026-10-28T18:10:00+00:00 2026-11-09T16:56:28+00:00 https://blog.hackersonsteroids.org/posts/htb-autopilot/ admin

HTB Autopilot: Season 12 week 4, an insane Windows box by ctrlzero. 4.5/5 from 122 reviews, 1,815 user owns, a two hour first blood. Live stats, spoiler-free.

2026-10-28T18:00:00+00:00 2026-10-28T18:00:00+00:00 https://blog.hackersonsteroids.org/posts/htb-stream/ admin

HTB Stream: Season 12 week 3, a medium Linux box by 7u9y. 2.4/5 from 323 reviews, the lowest on the board, and 3,368 user owns. Live stats, spoiler-free.

2026-10-03T15:30:00+00:00 2026-11-09T16:56:28+00:00 https://blog.hackersonsteroids.org/posts/htb-touch/ admin

HTB Touch: Season 12 week 2, an easy Windows box by TheCyberGeek. 4.3/5 from 362 reviews, 7,581 user owns in five weeks. Live stats and prep, spoiler-free.

2026-09-26T22:35:00+00:00 2026-09-26T22:35:00+00:00 https://blog.hackersonsteroids.org/posts/htb-layover/ admin

HTB Layover: the Season 12 opener, a medium Linux box by TRX. 4.3/5 from 7 reviews, 177 user owns on day one. Live stats and prep, spoiler-free.

2026-09-20T22:30:00+00:00 2026-11-09T17:07:19+00:00 https://blog.hackersonsteroids.org/posts/htb-scaffold/ admin

HTB Scaffold: active hard Windows box, 3.1/5 from 42 reviews, 582 user owns. Live stats, difficulty read and prep. Spoiler-free, no flags.

2026-09-20T22:15:00+00:00 2026-09-20T22:15:00+00:00 https://blog.hackersonsteroids.org/posts/htb-trustfall/ admin

HTB TrustFall: active insane Windows box, 4.8/5 from 22 reviews, 181 user owns. Live stats, difficulty read and prep. Spoiler-free, no flags.

2026-09-20T22:00:00+00:00 2026-11-09T17:07:19+00:00 https://blog.hackersonsteroids.org/posts/htb-management/ admin

HTB Management: active easy Linux box, 3.5/5 from 80 reviews, 1,510 user owns. Live stats, difficulty read and prep. Spoiler-free, no flags.

2026-09-20T18:45:00+00:00 2026-09-20T23:22:09+00:00 https://blog.hackersonsteroids.org/posts/forgotten-infrastructure-and-dangling-records/ Gabriel Martorelli

Subdomain takeover, dangling cloud and DNS records, backup systems, network printers and secrets leaking out through logs and telemetry.

2026-09-20T18:30:00+00:00 2026-09-20T23:22:09+00:00 https://blog.hackersonsteroids.org/posts/exposed-datastores-redis-mongodb-elasticsearch/ Gabriel Martorelli

Bind settings, ACLs and security rules, plus vector databases: stored data that becomes credentials the moment the service is reachable.

2026-09-20T18:15:00+00:00 2026-09-20T23:22:09+00:00 https://blog.hackersonsteroids.org/posts/electron-desktop-apps-and-browser-extensions/ Gabriel Martorelli

Node.js in the renderer, custom protocols with filesystem reach, extension permissions and content scripts, and secrets still sitting in source maps.

2026-09-20T18:00:00+00:00 2026-09-20T23:22:09+00:00 https://blog.hackersonsteroids.org/posts/mobile-application-attack-surface/ Gabriel Martorelli

Manifest and exported components, deep links and app links, WebView bridges, Keychain and Keystore, pinning and mobile API authentication.

2026-09-20T17:45:00+00:00 2026-09-20T23:22:09+00:00 https://blog.hackersonsteroids.org/posts/ml-infrastructure-and-model-supply-chain/ Gabriel Martorelli

Jupyter, MLflow tracking servers, GPU nodes and schedulers, MLOps trust boundaries and model weights that are also executable software.

2026-09-20T17:30:00+00:00 2026-09-20T23:22:09+00:00 https://blog.hackersonsteroids.org/posts/prompt-injection-and-llm-application-security/ Gabriel Martorelli

Untrusted text that gains authority, indirect injection, tool calling versus authorization, retrieval poisoning and MCP authorization in depth.

2026-09-20T17:15:00+00:00 2026-09-20T23:22:09+00:00 https://blog.hackersonsteroids.org/posts/websockets-grpc-and-graphql-authorization/ Gabriel Martorelli

Persistent connections few teams review, protobuf and reflection, and persisted queries: what authorization looks like after the handshake or the hash.

2026-09-20T17:00:00+00:00 2026-09-20T23:22:09+00:00 https://blog.hackersonsteroids.org/posts/api-authorization-bola-bfla-mass-assignment/ Gabriel Martorelli

Object and function level authorization, fields the client should never control, deprecated versions still running and what an OpenAPI schema does not prove.