Writeup for the HackTheBox machine Orion — a Craft CMS installation leaking server internals through a misconfigured devMode and vulnerable to unauthenticated remote code execution via CVE-2025-32432, a CVSS 10.0 flaw in Craft's image transformation endpoint.

Understand what shells are, the difference between reverse and bind shells, and how to use Netcat to establish remote access — a core skill for any penetration tester.

How I passed the eJPT certification in six hours - what the exam actually tests, why it isn't a CTF, and the enumeration habits that made the difference.

A detailed walkthrough of INE's Post-Exploitation CTF 2, covering SSH brute-forcing, hash cracking, lateral movement, and bypassing NTFS permissions using SeBackupPrivilege.

A comprehensive beginner's guide to Nmap - learn what it is, why it's essential, and master the most important scanning commands for network discovery and security auditing.

A comprehensive beginner-friendly walkthrough of the INE Post-Exploitation CTF challenge, covering libSSH exploitation, Linux enumeration, credential discovery, and privilege escalation techniques.

eJPT walkthrough exploiting ProFTPD and SMB misconfigurations, then escalating privileges via a SUID binary to capture four flags across two targets.

eJPT walkthrough covering SMB enumeration, password bruteforcing, hash cracking, FTP enumeration and web shell deployment to capture four flags.

eJPT walkthrough exploiting a vulnerable WordPress/FlatCore CMS and cracking credentials with Hydra and Metasploit to capture four flags across two targets.

A comprehensive guide to solving the Metasploit Framework CTF 2 challenge with detailed explanations, hints, and practical examples for EJPT preparation.