2026-09-08 9 min
[notes]
MCP Servers as an Attack Surface: Tools and Tokens
MCP servers as an attack surface: tools as executable capability, token audience binding, confused deputy problems and prompt injection with real reach.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2026-09-04 6 min
[notes]
Race Conditions in Web Applications: Finding the Window
Race conditions in web apps: the window between check and update, the single packet attack over HTTP/2, multi endpoint races and what actually fixes them.
2026-09-01 6 min
[notes]
BloodHound Beyond Pretty Graphs: Validating Edges
Using BloodHound past the shortest path: collection quality, reading an edge before running anything, session volatility and Cypher queries.
2026-08-28 5 min
[notes]
Hack The Box BlockSynergy Stats (Insane Linux)
HTB BlockSynergy: active insane Linux box closing Season 11, 3.9/5 from 95 reviews, 1,546 user owns. Difficulty read and prep, spoiler-free.
AD
2026-08-28 5 min
[notes]
Server-Side Template Injection: Detection to RCE
SSTI from detection to impact: plaintext versus code context, engine identification, sandbox escapes, and why remote code execution is not a given.