2026-06-12 7 min
[notes]
JWT Attacks for Pentesters: Beyond the none Algorithm
JWT attacks past alg none: algorithm confusion, weak HS256 secrets, kid injection, jwk and jku abuse, and the claim checks that actually matter.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2026-06-09 8 min
[notes]
Active Directory ACL Abuse: From Permission to Domain Admin
How Active Directory ACL abuse works: GenericAll, GenericWrite, WriteDACL and WriteOwner, how to find the path in BloodHound and how to validate it.
2026-01-28 5 min
[writeup]
OffSec Proving Grounds Mice Writeup (Windows)
Windows PG box. Remote Mouse 3.008 on port 1978 runs commands unauthenticated, FileZilla's recentservers.xml leaks divine's password, and its GUI gives SYSTEM.
2026-01-28 3 min
[writeup]
OffSec Proving Grounds Fired Writeup
CVE-2023-32315 creates an Openfire admin, a malicious plugin gives a shell, and the SMTP password stored in openfire.script turns out to be root's password.
2026-01-27 11 min
[writeup]
OffSec Proving Grounds Monster Writeup
Windows Proving Grounds box. A cookie based rate limit bypass (CVE-2018-11678) brute forces Monstra CMS, then XAMPP CVE-2020-11107 escalates to Administrator.