An Easy TryHackMe room that walks up the Pyramid of Pain: blocking a hash, an IP, and a domain, then writing Sigma rules for a registry change, a C2 beacon, and an attacker's discovery commands.

A Hard forensics room: a packet capture and a PowerShell memory dump, a brute-forced mailbox, a fileless stager, and an encrypted C2 channel unlocked with an RSA key recovered from memory.

A full attack chain against a Hard Windows box: an SNMP blind spot for the foothold, forgotten registry backups in a Recycle Bin, and a pass-the-hash to Administrator.

Abusing an assumption in a password-reset flow to redirect a victim's reset email to an address I control.

Flipping an admin flag, cracking a hashed cookie, and forging a base64 one to escalate from user to admin.

Finding an Insecure Direct Object Reference by watching what an account page loads behind the scenes.

Lab work from a TryHackMe web application security module, done against a deliberately vulnerable training app. Lab IPs are genericized and room answers (including a captured session token) are red...

Lab work from a TryHackMe web application security module, done against a deliberately vulnerable training app. Room-specific database names, table names, and recovered values are genericized; room...

Lab work from a TryHackMe web application security module, done in a deliberately vulnerable training environment. Room answers and flags are left out. To see where I got this from, and to give it ...

Details about the organization, hostnames, network layout, and vendor-specific configuration have been left out or generalized on purpose. TL;DR A research data platform we ran on a single RHEL ...