A network printer admin panel stores LDAP service-account credentials and lets the directory server be set to an arbitrary host; pointing it at a rogue listener on port 389 leaks the svc-printer password in cleartext, which logs in over WinRM for the user flag.

An exposed .git directory leaks an .htaccess rule requiring a custom Special-Dev header to reach a dev vhost whose file upload accepted zip-inside-.txt archives executable via the phar:// PHP stream wrapper, giving RCE as www-data and eventually root via a SUID Python2 binary and sudo easy_install.

A default SNMP community string leaks a process command line containing cleartext SSH credentials; an internal-only PandoraFMS v7.0NG.742 instance reached over an SSH SOCKS tunnel is then chained — an unauthenticated SQL injection (CVE-2021-32099) steals a privileged session and an events command injection (CVE-2021-32098) returns a reverse shell for the user flag.

Starting with assume-breach credentials, judith.mader's WriteOwner right on the management AD group was abused to grant herself GenericWrite over management_svc, enabling a shadow credentials attack that yielded management_svc's NT hash and a WinRM foothold.

A Roundcube 1.6.10 webmail instance reached via a fuzzed vhost is exploited with provided credentials through CVE-2025-49113 — an unvalidated _from parameter that triggers PHP object deserialization for RCE — and a reversibly-encrypted password stored in the Roundcube session table is recovered with the app's own decrypt.sh to pivot to a user over SSH.

An SMB null-session exposes all domain usernames via RID cycling; username-as-password spraying finds operator:operator, which reaches MSSQL where xp_dirtree uncovers a downloadable backup ZIP containing plaintext credentials for raven with WinRM access.

An exposed source backup reveals an upload filter that trusts forged PNG magic bytes and only checks the trailing extension, so a shell.php.png webshell yields code execution as apache; a root cron job that feeds upload filenames straight into a shell exec() is then abused with a malicious filename to pivot to the guly user and the user flag.

An unauthenticated MSSQL UNION injection on watch.streamio.htb dumped all user password hashes; cracking them gave admin login, and the admin panel's debug parameter passed user input directly to PHP include(), enabling source disclosure via php://filter and Remote File Inclusion through master.php's eval(file_get_contents()) to land a reverse shell.

A shopping web app accepts default admin credentials, and its XML order endpoint resolves external entities, letting a file:/// payload read a username-hinted user's SSH private key for an interactive login and the user flag.

A backdoored PHP 8.1.0-dev development build exposed via the X-Powered-By header accepted arbitrary OS commands through the User-Agentt header, giving a shell as james without credentials.

A download endpoint reads arbitrary files, leaking the hMailServer admin MD5 hash; those mail credentials send a CVE-2024-21413 MonikerLink email that coerces a user's NetNTLMv2 hash, which cracks to a password for a WinRM shell and the user flag.

DNS zone transfer exposes a hidden admin subdomain whose login is bypassed with SQL injection; an authenticated command injection field then grants a shell as www-data.

A dev subdomain leaks its .git directory, whose history hides a hardcoded Ghost admin password; the Ghost 5.58 importer (CVE-2023-40028) reads arbitrary files via a symlink in an imported ZIP, leaking SSH credentials from the Ghost config for the user flag.

A Jenkins CI server on port 50000 had authentication disabled, allowing unauthenticated access to the Groovy Script Console and remote code execution as jeeves\kohsuke.

The fifth blind SQLi oracle — when the app leaks nothing in-band (no message, no delay, no error), make the database server itself phone home. An Oracle XMLType external-entity trick fires a DNS lookup to a host you control. Plus the cookie-encoding gotcha that decides whether the payload parses at all.

A Request Tracker ticketing system left on its documented default root/password login exposes an admin panel where a user's SSH password sits in clear text inside a comment field, granting a direct SSH foothold and the user flag.

A map of the blind SQL injection labs in this series. When the query result never reaches the page, you fall back to an oracle — a side channel that leaks one bit at a time, or sends the answer out-of-band entirely. This post lays out the five oracle flavours, how to pick the right one by what the app leaks, and links each to its walkthrough.

A PHP application passes user-supplied filenames directly to include() with no validation, enabling LFI that leaks a 13x base64-encoded password — decoding it yields SSH credentials for charix, who holds a VNC password file granting a root graphical desktop session.

The app leaks nothing — no message, no error, no status change — so we turn response time into a 1-bit oracle, wrap each guess in a CASE that only sleeps when it is correct, and binary-search the administrator password out of the database one character at a time.

An unauthenticated GraphQL endpoint leaks a HelpDeskZ user's MD5 password, and the HelpDeskZ 1.0.2 ticket viewer's blind SQL injection lets you brute-force a staff SHA1 hash one character at a time — the recovered credential logs straight into SSH for the user flag.