Magic is a medium difficulty HTB machine which involves SQL injection attack, arbitrary file upload and SUID binary exploitation.

Most people know XXE. Few think to look for it inside a spreadsheet upload. But beneath every .xlsx is really a ZIP archive full of XML…

By Raj Kumar

How I Cracked the TryHackMe File Inclusion Challenges: A Deep Dive into LFI, Cookies, and $_REQUEST Bypasses

welcome to my first write-up. I started bug hunting about 3 months ago, and this was one of my first findings, so I would love to share it.

An IDOR vulnerability in shared links, a $700 bounty, and the invisible permission that wasn’t there

welcome to my first write-up. I started bug hunting about 3 months ago, and this was one of my first findings, so I would love to share it.

#Linux #HTBWalkthrough #HTBNexus #FileUpload #Gitea #Gobuster #fuff #subdomainEnumeration #GitPathTraversal #GitObjects

TL;DR SolarWinds fixed three critical SolarWinds Serv-U vulnerabilities on July 21, 2026. They allow privilege escalation and remote code execution on the file transfer server. SolarWinds rates ea…

TL;DR SolarWinds fixed three critical SolarWinds Serv-U vulnerabilities on July 21, 2026. They allow privilege escalation and remote code execution on the file transfer server. SolarWinds rates ea…

Nmap, sqlmap, wordlists, PHP shell

A storage-exhaustion flaw. A stored XSS that waited for an admin. Both hiding in the same “boring” file upload form that hadn’t been…

Microsoft recently pushed Windows 11 Build 26300.8935 to users in its preview program. The changelog highlights one useful gain. In certain scenarios, deleting large and heavily fragmented files n…