Overview This lab demonstrates a stored DOM-based XSS vulnerability where a custom JavaScript sanitiser uses String.replace() with a plain string argument — replacing only the first occurrence of ...

Tentacle is a Hard Linux box built around a Kerberos realm. A Squid proxy with an authentication bypass pivots into an internal network running a vulnerable OpenSMTPD (CVE-2020-7247) for the foothold; a plaintext msmtp password becomes a Kerberos ticket for the user shell; a squid-group-writable directory rsynced by a root cron plants a .k5login for the admin account; and an admin-group-readable krb5.keytab grants kadmin to mint a root principal and ksu to root — recon through root.

Lab PortSwigger Web Security Academy — DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded Difficulty: Practitioner CWE: CWE-79 (Cross-Site Scripting) Sub-class: Cl...

A web server hands out a downloadable Docker image whose discarded layers still hold a deleted SQLite database and source code; recovering a cracked admin hash and a hardcoded invite code unlocks a demo site whose profile form is blind Jinja2 SSTI, giving code execution as www-data — and a plaintext Passbolt config password reused for SSH lands the user flag as eddie.

PortSwigger’s DOM XSS in document.write sink using source location.search inside a select element lab demonstrates a case of DOM-based Cross-Site Scripting where the injection context is the inner ...

YPuffy is a Medium OpenBSD box where an anonymous LDAP bind leaks a user's NT hash, which pass-the-hashes into Samba to grab an unencrypted PuTTY key and SSH in. Root comes from a doas rule that lets the user run ssh-keygen as the SSH certificate authority owner, forging a root login certificate — this post covers recon through root.

Encoding double quotes in an HTML attribute stops attackers from breaking out of it — but it’s only half the story when that attribute is a href. The javascript: URI scheme executes without needing...

Watcher is a medium Linux box centred on a Zabbix monitoring server. A vhost leads to a Zabbix 7.0.0alpha1 instance with guest login enabled, and that low-privilege session is enough to drive CVE-2024-22120 — a time-based SQL injection in the Zabbix trapper protocol — to hijack the super-admin session and gain remote code execution as the zabbix user. This post covers recon through the foothold shell and the user flag.

A common partial fix for XSS is encoding angle brackets — it blocks <script> tag injection but misses a whole class of attacks where the reflection lands inside JavaScript itself. This lab de...

Omni is a Windows IoT Core box where the built-in Sirep Test Service hands out unauthenticated SYSTEM command execution. From there it's a registry-hive dump and crack into the Device Portal, then decrypting two stored PowerShell credential files to walk from app to administrator — this post covers recon through root.

Angle brackets are HTML-encoded so a <script> tag can't be injected — but the input lands inside a double-quoted attribute and the quote isn't encoded. Break out of the attribute and add your own event handler instead. One missed character is the whole bug.

Sweep is a medium Windows Active Directory box centered on Lansweeper. An enabled SMB guest account leaks the full user list via RID brute-forcing, and a username-equals-password spray lands a valid login for intern. From there a GenericAll ACL over the Lansweeper Admins group — which nests into Remote Management Users — is abused with net rpc to grant intern a WinRM shell and the user flag. This post covers recon through user.txt.

A client-side jQuery script copies a URL query parameter into an anchor's href with no scheme check, so returnPath=javascript:alert(document.cookie) turns the Back link into a script-runner. Unlike innerHTML sinks, this one only fires when the link is clicked.

Client-side XSS that never touches the server response: a script reads the URL query string and assigns it straight into an element with innerHTML. Because innerHTML never runs an injected script tag, fire the payload with an event handler instead — <img src=1 onerror=alert(1)>.

Slonik is a medium Linux box centered on NFS and PostgreSQL. NFS exports trust client-supplied UID/GID, so matching a local user to the share owner unlocks a private home directory leaking database credentials. PostgreSQL listens only on a local UNIX socket with peer-trust auth — forwarding that socket over SSH gives password-less superuser access, and COPY FROM PROGRAM turns it into command execution for the user flag. This post covers recon through user.txt.

Client-side XSS that never touches the server response: a script reads the URL query string and writes it straight into the page with document.write. Break out of the img src attribute with "><svg onload=alert(1)> and the alert fires from a plain link.

The persistent cousin of reflected XSS: a blog comment box saves your input and renders it raw into the post for every later visitor. No per-victim link needed — store the payload once and it fires for everyone. The full flow: scrape the session CSRF token, post a bare <script> comment, confirm it rendered un-encoded.

Rainbow is a medium Windows box built around a custom C++ web server. Anonymous FTP hands out the server binary and a developer note hinting at frequent crashes, which points straight at memory corruption. Port 8080 runs that server and is vulnerable to an SEH-based stack buffer overflow; exploiting it with a POP/POP/RET gadget and an egghunter yields a shell as the rainbow user. This post covers recon through the foothold shell and the user flag.

The simplest cross-site scripting case: a search box echoes your input straight back into the page with no encoding, so a bare <script> tag executes. The full triage — confirm the reflection, read the context, fire the payload — plus how to escalate from a harmless alert() to a real session theft.

Flustered is a medium Linux box centered on storage solutions. An unauthenticated GlusterFS server leaks a volume of MariaDB files containing Squid proxy credentials; the proxy reaches an internal Flask app vulnerable to Server-Side Template Injection, then world-readable GlusterFS certificates allow mounting a second volume (a user's home) to plant an SSH key. This post covers recon through user.txt.