TwoMillion is an Easy-difficulty Linux machine released to celebrate HackTheBox reaching 2 million users. It features a nostalgic recreation of the old HTB platform, involving an invite code bypass...

Facts is a Medium-rated Linux machine on HackTheBox that involves exploiting a Mass Assignment vulnerability in Camaleon CMS, discovering S3 credentials in the admin panel, and leveraging a sudo mi...

Kobold is an Easy-rated Linux machine on HackTheBox that focuses on subdomain enumeration, exploiting an unauthenticated RCE in an API-driven application, and leveraging Docker misconfigurations fo...

The CCTV machine on HackTheBox is a medium-difficulty Linux box that focuses on exploiting a video surveillance stack. The attack path involves exploiting a SQL injection in ZoneMinder to gather in...

Introduction Reactor is an Easy-rated Linux machine on HackTheBox that showcases a high-severity vulnerability in the Next.js framework. The exploitation involves an unauthenticated RCE via the Rea...

Introduction Connected is a Season 11 Linux machine on HackTheBox that features a FreePBX installation. The exploitation path involves an unauthenticated SQL injection in the Endpoint Manager modul...

Target IP: 10.10.10.245 Difficulty: Easy OS: Linux 1. Reconnaissance Nmap Scan PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http Foothold Discovery The web server on port ...

SUID (Set User ID) is a special file permission in Linux that allows users to run a binary with the permissions of the file owner (often root). The Security Risk If a binary with the SUID flag has...

Integrating security into the continuous integration/continuous deployment (CI/CD) pipeline ensures vulnerabilities are caught early in the development lifecycle. Static Application Security Testi...

Process injection is a evasion technique where malware runs malicious code in the address space of a legitimate Windows process (e.g., explorer.exe or svchost.exe). Classic API Sequence The most c...