Field notes from the front line of offensive security.
In-depth research, machine and challenge write-ups, step-by-step walkthroughs, and tactical guides drawn from real engagements and labs. Practical, technical, and written to help you understand not just what works — but why it works.
Part 7 of 7, the final phase of the HackTheBox RoadMap. Read the root flag and close out the engagement, then wrap the whole series with a quick-reference tool table and a set of Golden Rules distilling all seven parts. Includes a Pass-the-Hash lesson from the DanglingTree box.
Part 6 of the HackTheBox RoadMap. The payoff phase: escalating from a normal user to root on Linux or Domain Admin / SYSTEM on Windows. Covers sudo, SUID and cron abuse, group-based paths, Windows token privileges and service misconfigurations, plus a full Active Directory and AD CS escalation chain from the DanglingTree box.
Part 5 of the HackTheBox RoadMap. With a shell in hand, this phase walks through enumerating the box from the inside — users, sudo rights, SUID binaries, cron jobs and hidden credentials — across Linux, Docker containers and Windows. Includes real DPAPI and credential-chaining lessons from the DanglingTree box.
Part 4 of the HackTheBox RoadMap. This phase covers turning a confirmed vulnerability into a working shell: starting a listener, delivering a reverse-shell payload, and stabilising the session. Includes real lessons from the DanglingTree box on abusing management interfaces and pivoting to localhost-only services.
Part 3 of the HackTheBox RoadMap. This phase turns your scan and enumeration results into real attack vectors: you match service versions to known exploits with searchsploit, then test for SQLi, LFI/RFI, command injection, SSTI, XXE and common misconfigurations, with real lessons from the DanglingTree box.
Part 2 of the HackTheBox RoadMap series — the phase where you spend the most time. This guide covers enumerating every open service: HTTP/HTTPS manual checks, directory brute-forcing with gobuster and ffuf, six subdomain-discovery methods, and probing FTP, SSH, SMB, DNS, SNMP, MySQL, Redis, and WinRM — plus a real-world note from the DanglingTree box on how an anonymous SMB share leaked the foothold.
Part 1 of the HackTheBox RoadMap series — a structured, repeatable methodology for solving any HTB machine. This phase covers reconnaissance: discovering every open port and service with Nmap (fast, full, and UDP scans), reading the port signature, and plus a real-world note from the DanglingTree box on how the scan alone decides your entire playbook.
The first hour after a breach decides how bad it gets. This guide walks through the rapid response plan for 2026: how to recognise the warning signs, contain the damage before it spreads, work out exactly what was exposed, and lock everything back down. Ten clear steps — plus what to do afterwards so it doesn't happen again.
Almost every breach begins somewhere ordinary — a tab, a link, a login box. This guide breaks down the real browser threats of 2026 (phishing, malware, session hijacking, malvertising, and fraud), the seven everyday habits that stop most of them, and how to build protection layer by layer across your browser, network, system, and family.
A cyber attack is a deliberate attempt to break into a system, network, or device to steal, disrupt, or destroy data. This guide breaks down how attacks unfold — from reconnaissance to impact — and walks through the eight most common types: malware, phishing and privilege escalation, man-in-the-middle, DoS/DDoS, zero-day, DNS tunnelling, cryptojacking, and ransomware. It closes with the five defensive layers that meaningfully reduce your risk.
A step-by-step walkthrough of the GoodGames machine from Hack The Box, demonstrating how chaining SQL Injection, Server-Side Template Injection (SSTI) in a Flask/Jinja2 dashboard, and a Docker container escape via mounted filesystem SUID abuse leads to full root compromise — from a login form to host root.
A step-by-step walkthrough of the Sau machine from Hack The Box, demonstrating how chaining an SSRF vulnerability in Request Baskets (CVE-2023-27163) with unauthenticated command injection in Maltrail v0.53 and a systemd pager privilege escalation (CVE-2023-26604) leads to full root compromise — from filtered ports to root shell.