M57-Jean: Corporate Document Exfiltration Investigation
DFIR case study on the M57.biz Jean scenario: tracing a leaked employee spreadsheet from FTK Imager acquisition through Outlook PST analysis to a spear-phishing exfiltration timeline.
Read more 
HTB Sherlock SmartyPants
Windows Event Log DFIR with EvtxECmd and Timeline Explorer, using Microsoft Defender SmartScreen Debug logs to trace RDP access, tool installs, data theft, and anti-forensic log clearing.
Read more
HTB Sherlock Noxious
Network forensics on an Active Directory PCAP: spotting LLMNR poisoning from a rogue Responder host, rebuilding the captured NetNTLMv2 hash from Wireshark, and cracking it with Hashcat.
Read more
AuraWiper: Destructive Wiper Analysis
Static and dynamic analysis of a 64-bit Windows wiper: security-tool tampering, recovery inhibition, shadow copy deletion, BCD edits, raw MBR overwrite, and a forced fatal system error.
Read more
HTB Sherlock Baggage
Windows Shellbag analysis with SBECmd to reconstruct how an attacker searched for sensitive files, accessed a network share, staged the data, and compressed it for exfiltration.
Read more
HTB Sherlock PhantomRing
Reverse engineering a Linux ELF post-exploitation agent in Ghidra: its io_uring-based C2 channel, command set, privilege-escalation recon, and eBPF/ftrace anti-monitoring behavior.
Read more
Acquiring an SD Card with FTK Imager
Forensic acquisition lab: imaging an SDHC card to E01 with FTK Imager, splitting the image into segments, and verifying the MD5 and SHA1 hashes before analysis.
Read more
HTB Sherlock BFT
MFT (Master File Table) forensics with MFTECmd and TimeLine Explorer, tracing a phishing ZIP download through to the malicious stager file that connected to a C2 server.
Read more
DFIR First Image Analysis: Magnet AXIOM Walkthrough
Magnet AXIOM examination of the Dell Latitude CPi image, covering OS and install artifacts, user attribution, network configuration, installed hacking tools, webmail, and malware triage.
Read more
Tableau Forensic TD4: USB to SATA Acquisition
Standalone forensic duplication lab using the OpenText Tableau TD4: configuring case data and hashing, verifying source and destination, running the duplication, and reviewing the job history.
Read more
DFIR First Image Analysis: Autopsy Walkthrough
Autopsy-based DFIR walkthrough of a Dell Latitude CPi image, covering system artifacts, user attribution, network evidence, installed tools, malware, and webmail findings.
Read more
JetBrains Lab
LetsDefend JetBrains lab writeup using Wireshark to reconstruct TeamCity exploitation, webshell activity, and MITRE ATT&CK mapping.
Read more
HTB Sherlock KitsuneHook
Threat intelligence attribution exercise tracing a Winnti/APT41 campaign (RevivalStone and Operation CuckooBees) across vendor reporting, MITRE ATT&CK mappings, and malware tooling.
Read more
HTB Orion Writeup
Linux writeup chaining CraftCMS pre-auth RCE (CVE-2025-32432), a phpinfo environment leak, MySQL credential dumping, bcrypt cracking, and a telnetd authentication bypass (CVE-2026-24061) for root.
Read more
HTB Enigma Writeup
Linux writeup covering NFS onboarding credential leakage, mailbox pivoting, OpenSTAManager authenticated command injection, bcrypt cracking, and OliveTin local API privilege escalation.
Read more
HTB Nimbus Writeup
Hard Linux writeup covering SSRF to IMDS credentials, SQS access, unsafe YAML deserialization, worker container RCE, CodeBuild abuse, and core_pattern host escape.
Read more
HTB Nexus Writeup
Linux writeup covering vhost enumeration, Gitea Git history secret leakage, Krayin CRM upload RCE, password reuse, and Gitea template-sync privilege escalation.
Read more
HTB Sherlock ShadowBait
Full Windows intrusion timeline built with Hayabusa: a phishing macro document leads to PowerShell staging, DPAPI credential theft, RunasCs lateral movement, privilege escalation, and multi-layered persistence.
Read more
HTB TwoMillion Writeup
Linux writeup covering API enumeration, broken access control, command injection in VPN generation, and CVE-2023-0386 kernel privilege escalation.
Read more
PLUS-I & PLUS-II
LigaCTF 2026 ISC/SCADA writeup covering weak HMI credentials, Modbus coil control, and traffic-light state manipulation.
Read more
TryHackMe Cheese CTF
TryHackMe room covering web enumeration, PHP LFI to filter-chain RCE, SSH key abuse, and systemd timer privilege escalation.
Read more
HTB Checkpoint Writeup
Active Directory writeup covering ACL abuse, VSIX deployment, BadSuccessor/dMSA abuse, and memory forensics.
Read more
HTB VariaType Writeup
Linux writeup covering source exposure, arbitrary file write, web foothold, and sudo-based privilege escalation.
Read more
HTB WingData Writeup
Linux writeup covering Wing FTP exposure, configuration recovery, credential analysis, and privilege escalation.
Read more
HTB Connected Writeup
Linux writeup covering FreePBX enumeration, SQL injection, admin access, and privilege escalation.
Read more
HTB Silentium Writeup
Linux writeup covering web application flaws, token handling, credential reuse, and container-adjacent privilege escalation.
Read more
HTB Support Writeup
Windows writeup covering SMB enumeration, LDAP credential recovery, BloodHound analysis, and RBCD abuse.
Read more
HTB DevHub Writeup
Linux writeup covering web enumeration, Jupyter token exposure, API abuse, and privilege escalation.
Read more
HTB Reactor Writeup
Linux writeup covering web application analysis, Node.js debugging exposure, and privilege escalation.
Read more Fragnesia
LigaCTF 2026 ligactf2026, web, forensics writeup covering Fragnesia with analysis, solution steps, and final recovery notes.
Read more Chain Of Attack
LigaCTF 2026 ligactf2026, web, forensics writeup covering Chain Of Attack with analysis, solution steps, and final recovery notes.
Read more Detonate2
LigaCTF 2026 ligactf2026, reverse engineering, malware analysis writeup covering Detonate2 with analysis, solution steps, and final recovery notes.
Read more Find The C2 Server
LigaCTF 2026 ligactf2026, forensics, reverse engineering writeup covering Find The C2 Server with analysis, solution steps, and final recovery notes.
Read more GGEZAF
LigaCTF 2026 ligactf2026, forensics, boot2root writeup covering GGEZAF with analysis, solution steps, and final recovery notes.
Read more Lockbox
LigaCTF 2026 ligactf2026, forensics, reverse engineering writeup covering Lockbox with analysis, solution steps, and final recovery notes.
Read more Reborne
LigaCTF 2026 ligactf2026, web, forensics writeup covering Reborne with analysis, solution steps, and final recovery notes.
Read more Routine
LigaCTF 2026 ligactf2026, forensics, cryptography writeup covering Routine with analysis, solution steps, and final recovery notes.
Read more Spray And Pray I, II, III
LigaCTF 2026 ligactf2026, forensics, reverse engineering writeup covering Spray And Pray I, II, III with analysis, solution steps, and final recovery notes.
Read more
Intergalactic Keypad
CyberGame.SK cybergame sk, forensics, reverse engineering writeup covering Intergalactic Keypad with analysis, solution steps, and final recovery notes.
Read more
Hi
IBOH25 iboh25, forensics, reverse engineering writeup covering Hi with analysis, solution steps, and final recovery notes.
Read more
Rogue Access Point with Wifiphisher
Wireless lab running Wifiphisher against an owned test network: cloning the AP, deauthenticating the client, serving a captive-portal phishing page, and capturing the submitted key.
Read moreWEP Cracking Walkthrough
Step-by-step WEP cracking run in a controlled lab: monitor mode setup, targeted capture, fake authentication, ARP replay, and key recovery from collected IVs.
Read more Lesser Less
CyberGame.SK cybergame sk, forensics, reverse engineering writeup covering Lesser Less with analysis, solution steps, and final recovery notes.
Read more Shifted Payload
CyberGame.SK cybergame sk, reverse engineering, malware analysis writeup covering Shifted Payload with analysis, solution steps, and final recovery notes.
Read more
Beacon Flooding with MDK3
Wireless lab generating fake 802.11 beacon frames with MDK3 from a custom SSID list, then confirming the flood from a scanning station.
Read moreUncovering a Hidden SSID
Wireless lab showing why disabling SSID broadcast is not a security control: the network name is recovered from probe and association frames after a deauthentication.
Read moreWEP Key Recovery with ARP Replay
Wireless lab recovering a WEP key: capturing traffic from the target AP, accelerating IV collection with ARP replay injection, and cracking the key with aircrack-ng.
Read more
Ancient Text
International HACK@10 CTF 2026 hack10, forensics, cryptography writeup covering Ancient Text with analysis, solution steps, and final recovery notes.
Read more Baby Crypto
International HACK@10 CTF 2026 hack10, forensics, reverse engineering writeup covering Baby Crypto with analysis, solution steps, and final recovery notes.
Read more Hakari Domain
International HACK@10 CTF 2026 hack10, cryptography writeup covering Hakari Domain with analysis, solution steps, and final recovery notes.
Read more Malware Or Not
International HACK@10 CTF 2026 hack10, forensics, reverse engineering writeup covering Malware Or Not with analysis, solution steps, and final recovery notes.
Read more Detonator
International HACK@10 CTF 2026 hack10, forensics, reverse engineering writeup covering Detonator with analysis, solution steps, and final recovery notes.
Read more Easy RE
International HACK@10 CTF 2026 hack10, forensics, reverse engineering writeup covering Easy RE with analysis, solution steps, and final recovery notes.
Read more Easy RE 2
International HACK@10 CTF 2026 hack10, forensics, reverse engineering writeup covering Easy RE 2 with analysis, solution steps, and final recovery notes.
Read more Proton X1337
International HACK@10 CTF 2026 hack10, forensics, reverse engineering writeup covering Proton X1337 with analysis, solution steps, and final recovery notes.
Read more
Black Flash
UMCS Preliminary umcs preliminary, reverse engineering, binary exploitation writeup covering Black Flash with analysis, solution steps, and final recovery notes.
Read more Cyber BlindBox
UMCS Preliminary umcs preliminary, forensics, reverse engineering writeup covering Cyber BlindBox with analysis, solution steps, and final recovery notes.
Read more Spinning Cat
UMCS Preliminary umcs preliminary, reverse engineering, binary exploitation writeup covering Spinning Cat with analysis, solution steps, and final recovery notes.
Read more Makmal Buta, UM
UMCS Preliminary umcs preliminary, forensics, reverse engineering writeup covering Makmal Buta, UM with analysis, solution steps, and final recovery notes.
Read more The Hexed Protocol
UMCS Preliminary umcs preliminary, forensics, reverse engineering writeup covering The Hexed Protocol with analysis, solution steps, and final recovery notes.
Read more Dojo Routing Breach
UMCS Preliminary umcs preliminary, forensics, reverse engineering writeup covering Dojo Routing Breach with analysis, solution steps, and final recovery notes.
Read more Packet Puzzle
UMCS Preliminary umcs preliminary, forensics, reverse engineering writeup covering Packet Puzzle with analysis, solution steps, and final recovery notes.
Read more The Winning Shot
UMCS Preliminary umcs preliminary, forensics, reverse engineering writeup covering The Winning Shot with analysis, solution steps, and final recovery notes.
Read more Noisy Penguins
UMCS Preliminary umcs preliminary, web, forensics writeup covering Noisy Penguins with analysis, solution steps, and final recovery notes.
Read more Donut Calculator
UMCS Preliminary umcs preliminary, forensics, reverse engineering writeup covering Donut Calculator with analysis, solution steps, and final recovery notes.
Read more Varsity Lake Sonata
UMCS Preliminary umcs preliminary, forensics, reverse engineering writeup covering Varsity Lake Sonata with analysis, solution steps, and final recovery notes.
Read more VideoLauncher
UMCS Preliminary umcs preliminary, forensics, reverse engineering writeup covering VideoLauncher with analysis, solution steps, and final recovery notes.
Read more Cloud AI Whisperer
UMCS Preliminary umcs preliminary, forensics, reverse engineering writeup covering Cloud AI Whisperer with analysis, solution steps, and final recovery notes.
Read more FUK U PHP
UMCS Preliminary umcs preliminary, web, forensics writeup covering FUK U PHP with analysis, solution steps, and final recovery notes.
Read more Guess The Pin
UMCS Preliminary umcs preliminary, web, forensics writeup covering Guess The Pin with analysis, solution steps, and final recovery notes.
Read more I DO: The Veiled Vow
UMCS Preliminary umcs preliminary, web, forensics writeup covering I DO: The Veiled Vow with analysis, solution steps, and final recovery notes.
Read more NexusCRM
UMCS Preliminary umcs preliminary, web, forensics writeup covering NexusCRM with analysis, solution steps, and final recovery notes.
Read more REDISTRIBUTE
UMCS Preliminary umcs preliminary, web, forensics writeup covering REDISTRIBUTE with analysis, solution steps, and final recovery notes.
Read more Zip A Dip Doo Dah
UMCS Preliminary umcs preliminary, web, reverse engineering writeup covering Zip A Dip Doo Dah with analysis, solution steps, and final recovery notes.
Read more
Ninja Nerds
UMassCTF 2026 umassctf2026, forensics writeup covering Ninja Nerds with analysis, solution steps, and final recovery notes.
Read more
DiceCTF 2026 - Good Vibes
Full solution and analysis of the DiceCTF Good Vibes challenge involving a custom VPN client and AES-GCM traffic decryption.
Read more DiceCTF 2026 - Leadgate
Writeup for the DiceCTF 2026 misc and ML challenge leadgate, solved by inverting the fine-tuning perturbation of a GPT-2 checkpoint.
Read more DiceCTF 2026 - Plane-or-Exchange
Writeup for the DiceCTF cryptography challenge Plane-or-Exchange, breaking a custom key exchange via leaked polynomial invariants.
Read more
KnightCTF 2026 - KnightCloud
KnightCloud SaaS premium bypass via exposed internal API, IDOR, and broken access control.
Read more
ADI RaSA
Bahtera 3108 2025 cryptography writeup covering a three-prime RSA modulus, factorization, private-key recovery, and flag decryption.
Read more COMMANDer
Bahtera 3108 2025 web writeup for COMMANDer, inspecting the pilihan API response and submitting the recovered command to the check endpoint.
Read more Komik
Bahtera 3108 2025 miscellaneous writeup for Komik, using Unicode steganography to recover the hidden flag from a short text passage.
Read more Malayan Heroine
Use the nickname You Loy-De to identify a Malayan heroine, then research her children to construct the flag.
Read more Maznah Legacy
Reverse the kunci_diraja validation routine and brute-force its printable input characters to recover the accepted flag.
Read more Menara Berkembar
Bahtera 3108 2025 Boot2Root writeup covering an upload-based foothold, credential discovery, SSH access, and sudo tar wildcard privilege escalation.
Read more Operation Nyet
Analyze an E01 USB image, deobfuscate a batch file, reconstruct its Base64 payload, and recover the Operation Nyet flag.
Read more Pelumba Negara
Bahtera 3108 2025 web writeup for Pelumba Negara, using Jinja2 server-side template injection to enumerate files and assemble flag fragments.
Read more Pemimpin
Bahtera 3108 2025 web writeup for Pemimpin, completing the Malaysian prime-minister identification quiz and reviewing the answers to reveal the flag.
Read more Permainan Lagenda
Bahtera 3108 2025 miscellaneous writeup for Permainan Lagenda, documenting the visual challenge and the recovered legendary snake-game flag.
Read more SuperMokh
Bahtera 3108 2025 web writeup for SuperMokh, escalating a guest session to admin by modifying and replacing a JWT authentication token.
Read more The Pocket Rocketman
Bahtera 3108 2025 cryptography writeup covering RSA with consecutive close primes, Fermat factorization, and plaintext recovery.
Read more Tok Janggut
Repair a corrupted JPEG header to recover Tok Janggut's historical image and the flag hidden inside it.
Read moreNo writeups match your search.