Linux Insane: STACKEDStacked is an insane Linux box built around a LocalStack container, an AWS service emulator running on the target itself. It teaches how a blind XSS in a header nobody sanitized leads to an internal hSep 7, 2026·8 min read
Cloudgoat Easy: SQS Flag ShopIn this lab, we'll be doing a walkthrough on the sqs_flag_shop cloudgoat scenario. Summary of the pathStart as cg-sqs-user with a web app -> Read our inline policy and find an assumable role -> EnumerAug 20, 2026·6 min read
Cloudgoat Easy: IAM Privilege Escalation by Key RotationIn this lab, we'll be doing a walkthrough on the iam_privesc_by_key_rotation cloudgoat scenario. Summary of the pathStart as manager user -> Enumerate users, roles, and policies -> Find SelfManageAcceAug 17, 2026·8 min read
Cloudgoat Easy: Beanstalk SecretsIn this lab, we'll be doing a walkthrough on an easy cloudgoat lab. Summary of the pathEnumerate Beanstalk environment on low priv user -> Get environment existing configuration -> Find hard-coded accAug 15, 2026·4 min read
HTB CJCA: Thoughts and AdviceI passed the CJCA, Hack The Box's first junior-level cert. If you're new to the field, take it. If you already work in security, skip it unless you can get it free. I initially didn't plan to take thiJul 24, 2026·4 min read
DOWN - HackTheBoxDown is a retired easy Linux machine that involves exploiting a web service vulnerable to Server-Side Request Forgery (SSRF) due to weak input sanitization and improper URL validation. By leveraging this flaw, we retrieve the source code of the web a...Jul 3, 2025·4 min read
0xL4ugh CTF - ManifestoThis is an easy challenge, except... it's written in Clojure. Can you find your way through all of these parentheses and come out victorious?Dec 29, 2024·3 min read
