Sometimes the interesting part of a bug isn’t finding it, it’s proving it. This one is an SSRF, which by itself isn’t rare. What made it worth a writeup is that the target actually had a guard agai...

Overview Nexus is a Linux machine that chains several web and infrastructure weaknesses into full system compromise. The attack begins with virtual host enumeration that reveals a self-hosted Gite...

This one started as a pretty simple idea: whenever I see an API parameter that looks like it wants a hostname or a URL, I try feeding it one that points back at me, or at somewhere it really should...

While I was testing the registration flow of a Magento-based website, I ran into something pretty interesting: I could completely bypass all the frontend security controls just by talking directly ...

Introduction Web Cache Deception (WCD) is a vulnerability that occurs when a caching layer stores sensitive, user-specific content and later serves it to unauthenticated users. The attack typical...

Overview Silentium is a Linux machine that involves exploiting multiple vulnerabilities to gain full system compromise. The attack begins by discovering a staging virtual host and abusing a passwo...

Overview Reactor is a Linux machine that involves exploiting a vulnerable Next.js application. By abusing CVE-2025-55182, it is possible to achieve remote command execution, access application fil...

Overview Facts is a Linux machine that involves exploiting multiple vulnerabilities in Camaleon CMS. By chaining a privilege escalation vulnerability with a path traversal issue, it is possible to...

Overview DevHub is a Linux machine that focuses on exploiting a vulnerable MCPJam Inspector instance. The attack begins by identifying an exposed MCP service and researching a known remote code ex...

Overview Connected is a Linux machine centered around exploiting vulnerabilities in FreePBX. The attack begins with the discovery of an unauthenticated SQL injection vulnerability that allows modi...