boxes

All of the boxes, Sherlocks, and various other practice.

Hands-on security challenges spanning offensive and defensive domains, each with detailed write-ups covering methodology, tooling, and lessons learned. Purple team focus: analyzing red team challenges as an attacker (exploitation, privilege escalation) and blue team challenges as a responder (threat hunting, timeline analysis, IOC extraction).

Lab stats · 113 writeups
By platform Total 113
HackTheBox · Hacker
48
TryHackMe
24
HTB Challenges
16
Sherlocks
7
CyberDefenders
5
Blue Team Labs
10
Crackmes
0
pwnable.kr
3
pwnable.tw
0
By team Total 113
Red Team Labs
88
Blue Team Labs
22
Reverse Engineering Labs
3
Insane
Hard
Medium
Easy
Very Easy
Red Team Labs HackTheBox · Hacker

Snapped

Triggered and pilfered Nginx UI backups.

SmartHire

Active challenge – details withheld per TOS

DevHub

Active challenge – details withheld per TOS

MakeSense

Active challenge – details withheld per TOS

Popcorn

Exploited file upload on torrent host

Haircut

Leveraged command injection vulnerability

Cronos

SQLi auth bypass, executed command injection

SolidState

Exploited JAMES SMTP server

Celestial

Exploited NodeJS deserialization vulnerability

Passage

Exploited CuteNews public vulnerability

Jeeves

Abused Jenkins Script Console.

Enigma

Active challenge – details withheld per TOS

Reactor

Active challenge – details withheld per TOS

Cohort

Active challenge – details withheld per TOS

HTB Blue

Exploited EternalBlue SMB vulnerability (MS17-010)

Jerry

Used default credentials to upload file via Tomcat

Nibbles

Exploited Nibbleblog public vulnerability

Knife

Exploited vulnerable PHP version

Remote

Discovered NFS credentials, executed authenticated exploit

Blocky

Decompiled JAR to extract credentials

Bashed

Discovered exposed CLI page with RCE

Grandpa

Abused IIS WebDAV vulnerability to execute code

Granny

Uploaded web shell via HTTP PUT

Irked

Leveraged UnrealIRCd exploit for RCE

Optimum

Exploited HFS 2.3 public vulnerability

GreenHorn

Discovered credentials in exposed repository

Sense

Exploited default credentials via known exploit

Sau

Exploited SSRF to access internal resources

BoardLight

Used default credentials with public exploit

Planning

Active challenge – details withheld per TOS

Titanic

Exploited LFI to steal credentials

Arctic

Exploited CFIDE vulnerability

Analytics

Escalated privilege via environment variables

Devvortex

Exploited stolen credentials via password reuse

Code

Bypassed Python word and import blacklists.

Love

Exploited public vulnerability in voting system

Curling

Exploited template injection using discovered password

OpenAdmin

Exploited Ona public vulnerability

Dog

Exploited RCE and exposed credentials.

Cap

Leveraged IDOR to access cleartext credentials

Lame

Exploited distcc service for remote code execution

Bank

Abused PHP file upload functionality.

Beep

Exploited Elastix LFI vulnerability.

Legacy

Exploited SMB vulnerability (MS08-067) for RCE

CodePartTwo

Exfilitrated Exposed Users Database.

MonitorsTwo

Exfilitrated Exposed Users Database.

Silentium

Active challenge – details withheld per TOS

Devel

Uploaded web shell via FTP server
TryHackMe

Brainpan

Wrote buffer overflow exploit for shell

Daily Bugle

Exploited Joomla via public vulnerability

Retro

Discovered credentials and executed theme code injection

Mr. Robot

Brute-forced credentials using exposed wordlist

Brainstorm

Wrote buffer overflow exploit

HackPark

Brute-forced credentials and uploaded file

Pickle Rick

Discovered exposed default credentials command panel

Steel Mountain

Exploited HttpFileServer 2.3 public vulnerability

Alfred

Discovered exposed script panel via default credentials

Game Zone

Used SQLMap to retrieve hash, gained SSH access

Skynet

Discovered credentials

Overpass 2

Captured credentials using Wireshark

Corp

Bypassed whitelist in application

Blaster

Discovered credentials and gained RDP access

Vulnversity

Bypassed file upload restrictions

SimpleCTF

Exploited CMS via public vulnerability

Ignite

Exploited Fuel CMS via public vulnerability

Colddbox - Easy

Brute-forced credentials, exploited theme injection

Billing

Exploited HTTP parameter for command injection

Library

Brute-forced SSH with Hydra

Ice

Executed public exploit

THM Blue

Gained remote access via MS17-010

Kenobi

Retrieved private key over SMB

Buffer Overflow Prep

Practiced buffer overflow exploitation techniques
HTB Challenges

Prometheon

Active challenge – details withheld per TOS

Wander

Active challenge – details withheld per TOS

TrynaSob Ransomware

Inject an LLM prompt to expose secrets.

External Affairs

Inject an LLM prompt to approve application.

Cred Hunter

Created Script To Analyze Data Dump.

PINsmith

Programmed a Python to Fix Data.

WebVault Time Machine Investigation

Performed Historical Web Intestigation Using Archives.

MinMax

Identify smallest and largest numbers in dataset.

Social Media Investigation Hub

Active challenge – details withheld per TOS

OpenSecret

Discovered hard-coded secret in source code.

SpookyPass

Extracted STRINGS to steal password.

Questionaire

Took a pop quiz, hotshot.

Mathematics

Completed a math pop quiz.

Behind The Scenes

Active challenge – details withheld per TOS

The Suspicious Reviewer

Investigate Fraudulent Reviewer Profile to Uncover Contact.

The Suspicious Domain

Investigate domain infrastructure to Uncover Campaign Links.
Blue Team Labs Sherlocks

ElectricBreeze-2

Active challenge – details withheld per TOS

Meerkat

Investigated PCAPs and correlated log data.

Bumblebee

Examined databases and correlated log data.

Noted

Investigated Notepad++ artifacts after exfiltration attack.

Brutus

Analyzed logs and identified brute-force.

PhishNet

Analysed a phishing email and attachment.

Unit42

Reviewed event logs for malware distribution.
CyberDefenders

Fake GPT Lab

Analyzed JS credential stealer malware

WebStrike Lab

Reviewed PCAP for Webshell Upload Attack.

PoisonedCredentials Lab

Reviewed PCAP for LLMNR/NBT-NS Poisoning Attack.

Oski Lab

Analyzed Virustotal and Any.Run virus reports.

Web Investigation Lab

Reviewed PCAP for SQL Injection Attack.
Blue Team Labs

Reverse Engineering - Another Injection

Active challenge – details withheld per TOS

Phishing Analysis

Active challenge – details withheld per TOS

Malware Analysis - Ransomware Script

Active challenge – details withheld per TOS

The Report

Active challenge – details withheld per TOS

ILOVEYOU

Active challenge – details withheld per TOS

MELISSA

Active challenge – details withheld per TOS

Phishing Analysis 2

Active challenge – details withheld per TOS

PowerShell Analysis Keylogger

Active challenge – details withheld per TOS

Meta

Reviewed jpeg metedata and reverse image search.

ATT&CK

Mapped adversary tactics using MITRE ATT&CK.
Reverse Engineering Labs pwnable.kr

Fd

Pass the correct Input/Output value.

Bof

Overwrite the password on the stack.

Cmd1

Utilize absolute path to bypass PATH restrictions.