Overview Nexus is a Linux machine that chains several web and infrastructure weaknesses into full system compromise. The attack begins with virtual host enumeration that reveals a self-hosted Gite...

This one started as a pretty simple idea: whenever I see an API parameter that looks like it wants a hostname or a URL, I try feeding it one that points back at me, or at somewhere it really should...

While I was testing the registration flow of a Magento-based website, I ran into something pretty interesting: I could completely bypass all the frontend security controls just by talking directly ...

Introduction Web Cache Deception (WCD) is a vulnerability that occurs when a caching layer stores sensitive, user-specific content and later serves it to unauthenticated users. The attack typical...

Overview Silentium is a Linux machine that involves exploiting multiple vulnerabilities to gain full system compromise. The attack begins by discovering a staging virtual host and abusing a passwo...

Overview Reactor is a Linux machine that involves exploiting a vulnerable Next.js application. By abusing CVE-2025-55182, it is possible to achieve remote command execution, access application fil...

Overview Facts is a Linux machine that involves exploiting multiple vulnerabilities in Camaleon CMS. By chaining a privilege escalation vulnerability with a path traversal issue, it is possible to...

Overview DevHub is a Linux machine that focuses on exploiting a vulnerable MCPJam Inspector instance. The attack begins by identifying an exposed MCP service and researching a known remote code ex...

Overview Connected is a Linux machine centered around exploiting vulnerabilities in FreePBX. The attack begins with the discovery of an unauthenticated SQL injection vulnerability that allows modi...

Introduction Password reset functionality is one of the most sensitive features in any web application. A single implementation flaw can lead to full Account Takeover (ATO), allowing attackers to ...