Pentest Notes
  • 🏠/home/x3m1Sec/.pt-notes
  • 📝Pentest Notes
    • 🔍Information Gathering
    • 📜Protocols and Services
      • DNS
      • FTP
      • IMAP
      • IPMI
      • MSSQL
      • MySQL
      • NFS
      • Oracle TNS
      • POP3
      • RDP
      • SMB
      • SMTP
      • SNMP
    • 🕸️Web Applications
      • Web Attacks
        • Cross Site Scripting (XSS)
        • SQL Injection (SQLi)
        • File Upload Vulnerabilities
        • Insecure Direct Object References (IDOR)
        • OS Command Injection
        • Local File Inclusion (LFI)
        • Remote File Inclusion (RFI)
        • XML External Entities (XXE)
        • HTTP Verb Tampering
      • Web Technologies
        • Tomcat
        • CGI Applications
        • WordPress
        • SAP Netweaver
        • Joomla
        • Drupal
        • Gitlab
        • Jenkins
        • Microsoft IIS
        • osTicket
        • PRTG Network Monitor
        • Splunk
      • Fuzzing
    • 📂Active Directory
      • Initial Access
      • Internal Enumeration & Lateral Movement
      • Privilege Escalation to Domain Admin using Known Exploits
      • Domain Trusts
    • 🐧Linux Privilege Escalation
      • Enumerating Attack Vectors
      • Privileged Groups
      • Environment Variables Abuse
      • Capabilities Abuse
      • Programs, Jobs and Services
      • Miscellaneous Techniques
      • Recent CVEs
    • 🪟Windows Privilege Escalation
      • Enumerating Attack Vectors
      • Excessive User Rights Abuse
      • Built-in Groups Abuse
      • File System ACLs
      • Services Hijacking
      • User Account Control (UAC) Bypass
      • Living off the Land
    • 🐛Bug Bounty Hunting
      • Bug Bounty Tools
    • 👾Utilities, Scripts and Payloads
      • Shells and Payloads
      • Metasploit Framework
      • File Transfers
      • Pivoting, Tunneling, Port Forwarding
      • Password Attacks
      • Spawn TTY Shells
  • 🎮CTFs
    • 🟩Hack The Box
      • Busqueda
      • Help
      • Sau
      • Updown
      • Broker
      • Monitored
      • Sea
      • Nibbles
    • 🔴TryHackMe
  • 🎓Road to certification
    • eJPTv2
      • My review
    • CPTS
      • CheatSheet
    • OSCP
      • OSCP Preparation
      • Cheatsheets
Powered by GitBook
On this page
  • What are CTFs?
  • Platforms Covered
  • 🟩 Hack The Box
  • 🔴 TryHackMe
  • Benefits of CTFs
  • How to Use These Writeups
  • Methodology

CTFs

PreviousSpawn TTY ShellsNextHack The Box

Last updated 20 days ago

This section contains my personal collection of CTF writeups, organized by platform. CTFs are cybersecurity competitions that help develop and test penetration testing skills in a controlled environment.

What are CTFs?

Capture The Flag (CTF) competitions are cybersecurity challenges where participants solve security puzzles by exploiting vulnerabilities in systems, applications, or files to obtain a "flag" - usually a specific string of text that proves successful completion.

Platforms Covered

Industry-leading cybersecurity training platform with various machines and challenges ranging from beginner to expert difficulty.

Security training platform with guided "rooms" designed to teach specific cybersecurity concepts and techniques.

Benefits of CTFs

  • Practical application of offensive security techniques

  • Learning to think like an attacker

  • Exposure to various technologies and vulnerability types

  • Development of problem-solving skills

  • Documentation practice through writeups

How to Use These Writeups

These writeups serve as:

  • Personal reference for techniques and approaches

  • Knowledge sharing with the security community

  • Documentation of my learning journey

Note: If you're attempting these challenges yourself, I recommend trying to solve them independently before consulting these writeups.

Methodology

In general, my approach to CTFs follows this methodology:

  1. Reconnaissance - Information gathering

  2. Enumeration - Finding potential entry points

  3. Exploitation - Leveraging vulnerabilities

  4. Privilege Escalation - Gaining higher permissions

  5. Post-Exploitation - Finding flags and documenting findings

Happy hacking!

🎮
🟩 Hack The Box
🔴 TryHackMe