Community Hub

📚 Writeups, Bug Bounty Reports & Resources

The latest community writeups, spoiler-safe hints, freshly launched labs, auto-gathered bug bounty reports from around the web, and a curated toolbox — one place, every link.

🐞 Bug Bounty Reports

Auto-gathered from public writeup feeds · refreshed every 6h

CVE-2024-45195: Apache OFBiz Unauthenticated Remote Code Execution (Fixed)

RCEForced browsingBroken authorization

Ryan Emmons · Apache OFBiz · 2024-09-05

Vulnerabilities in Open Source C2 Frameworks

RCEOS command injectionAuthentication bypassArbitrary file download

Laurence Tennant · Bishop Fox (Sliver), Havoc · 2024-09-18

Living off the VPN — Exploring VPN Post-Exploitation Techniques

Hardcoded secretsCredentials sent over unencrypted channel

Ori David (@oridavid123) · Ivanti (Connect Secure), Fortinet (Fortigate VPN) · 2024-08-07

Angular-ing for AuthZ, Problematic anti-patterns in Single Sign On Systems

SSOAuthentication bypass

Traceable ASPEN · - · 2024-03-05

Pwn2Own Miami: Aveva Edge Arbitrary DLL Loading Vulnerability

Arbitrary DLL loadingRCE

Piffd0s (@piffd0s) · AVEVA · 2024-08-01

How 100% Manual Hacking (Without Even Kali And Burp) Led To 2 Medium Vulnerabilities On YesWeHack

XSS

Manan Sanghvi (@An____Anonymous) · - · 2024-09-05

When Certificates Fail: A Story of Bypassed MFA in Remote Access

2FA / MFA bypassCitrix

Michael Eder (@michael_eder_) · - · 2024-09-09

Data Theft in Salesforce: Manipulating Public Links

SOQL injection

Nitay Bachrach · Salesforce · 2024-09-16

Logic Flaw: I Can Block You from Accessing Your Own Account

Logic flaw

Hashim Amin · - · 2024-09-13

How to Bypass Golang SSL Verification

SSL verification bypassSecurity code review

Michael Pasternak · - · 2024-07-15

Plug Security Holes in React Apps That Can Lead to API Exploitation

SSOJWTBroken authenticationMissing authentication

Eaton Z. (@XeEaton) · Siemens · 2024-07-31

Attacking PowerShell CLIXML Deserialization

Insecure deserializationRCE

Alexander Andersson · Microsoft · 2024-09-13

Microsoft Windows MSI Installer - Repair to SYSTEM - A detailed journey

Local Privilege Escalation

Michael Baer · Microsoft (Windows) · 2024-09-12

Unmasking Harmful Content in a Medical Chatbot: A Red Team Perspective

AILLM JailbreakChatbot

William Wallace (@phyr3wall) · - · 2024-09-05

Exploiting Vulnerabilities in a TLD Registrar to Takeover Tether, Google, and Amazon

TLD hacking

Sam Curry (@samwcyo) · - · 2021-11-30

Spip Preauth RCE 2024: Part 2, A Big Upload

RCEFile uploadSecurity code review

Laluka (@TheLaluka) · SPIP · 2024-09-04

[2,500$ Bug Bounty Write-Up] Remote Code Execution (RCE) via unclaimed Node package

RCEDependency confusion 💰 2,500

Fuleki Ioan · - · 2024-09-18

Interesting Story of an Account Takeover Vulnerability

Account takeoverHost header injection 💰 2,000

Deepanshu (@golu_369) · - · 2024-09-12

Revival Hijack – PyPI hijack technique exploited in the wild, puts 22K packages at risk

CI/CDSupply chain attack

Andrey Polkovnichenko, Brian Moussalli · PyPI · 2024-09-04

Directory Traversal, SQL Injection and Server-Side Request Forgery

Path traversalSQL injectionSSRF

Chris McCurley (@chrisrmccurley) · Sage · 2024-09-10

Getting code execution on Veeam through CVE-2023-27532

RCEInsecure deserializationSecurity code review

Alain Mowat (@plopz0r) · Veeam · 2024-09-10

Microsoft Copilot: From Prompt Injection to Exfiltration of Personal Information

AILLMPrompt injection

Johann Rehberger (wunderwuzzi23) · GitHub (Copilot) · 2024-08-26

SSTI in Bug Bounty Program: The Time I Played with Handlebars and Broke Stuff

SSTI

Ali Zamini · - · 2024-09-05

Government Emails at Risk: Critical Cross-Site Scripting Vulnerability in Roundcube Webmail

XSSSecurity code review

Oskar Zeino-Mahmalat · Roundcube · 2024-08-05

We Spent $20 To Achieve RCE And Accidentally Became The Admins Of .MOBI

RCETLD hacking

watchTowr (@watchtowrcyber) · - · 2024-09-11

Zero-Click Calendar invite — Critical zero-click vulnerability chain in macOS

RCEArbitrary file writeArbitrary file deleteTCC bypass

Mikko Kenttälä (@Turmio_) · Apple (macOS) · 2024-09-13

Escalating From Reader To Contributor In Azure API Management

Privilege escalation

Christian Håland · Microsoft (Azure) · 2024-09-13

Hijacking SQL Server Credentials using Agent Jobs for Domain Privilege Escalation

Privilege escalation

Scott Sutherland · - · 2024-09-10

Recursive Amplification Attacks: Botnet-as-a-Service

DDoS

Ben Kofman, Ryan Grunsten · - · 2024-07-24

Self-XSS to ATO via Site Features

Self-XSSAccount takeover

Hossein Shourabi (@hoseinshurabi) · - · 2024-09-08

$15k RCE Through Monitoring Debug Mode

RCELFIDebug mode enabled 💰 15,000

Omar (@0x0ld) · - · 2024-08-28

Back To School - Exploiting A Remote Code Execution Vulnerability In Moodle

RCESecurity code review

RedTeam Pentesting (@RedTeamPT) · Moodle · 2024-08-27

How I Got $250 For My Second Bug on HackerOne

OAuthSession expiration issue 💰 250

Likith Teki · - · 2024-09-01

Zomatoooo! IDOR in Saved Payments

IDOR

Prateek Srivastava · Zomato · 2024-09-04

CSRF Bypass Using Domain Confusion Leads To ATO

CSRFAccount takeover 💰 4,000

Osama Aly · - · 2024-08-28

P3 (Medium) : How I Gain Access To NASA's Internal Workspace?!

Information disclosure

Sri Shavin Kumar · NASA · 2024-09-03

IIS welcome page to source code review to LFI!

LFIBlind SSRFSecurity code review

Omar Ahmed (@spaceboy2O) · - · 2024-09-01

WordPress GiveWP POP to RCE (CVE-2024-5932)

RCEPHP pop chainPHP object injectionSecurity code review

Julien Ahrens (@MrTuxracer) · Wordfence · 2024-08-26

The Hunt for XXE to LFI: How I Uncovered CVE-2019–9670 in a Bug Bounty Program

XXELFIComponents with known vulnerabilities

Karthikeyan.V (@karthithehacker) · - · 2024-08-31

Bypassing CSP via URL Parser Confusions : XSS on Netlify’s Image CDN

XSSCSP bypass

Sudhanshu Rajbhar (@sudhanshur705) · Netlify · 2024-09-01

Basic HTTP Authentication Risk: Uncovering pyspider Vulnerabilities

Reflected XSSCSRFSecurity code review

Yaniv Nizry (@YNizry) · pyspider · 2024-09-02

Analysis of CVE-2024-43044 — From file read to RCE in Jenkins through agents

RCEArbitrary file read

Gabriel Quadros (@gqsilva), Ricardo Silva (@rick2600) · Jenkins · 2024-08-29

CVE-2024-37079:

Integer underflowBuffer OverflowMemory corruption

Grigory Dorodnov, Guy Lederfein (@glederfein) · VMware · 2024-08-28

Breaking Down Barriers: Exploiting Pre-Auth SQL Injection In WhatsUp Gold - CVE-2024-6670

SQL injectionReverse engineeringSecurity code review

Sina Kheirkhah (@SinSinology) · Progress (WhatsUp Gold) · 2024-08-30

Key and E: A Pentester’s Tale on How a Photo Opened Real Doors

Red team

Patricia Gagnon-Renaud · - · 2024-08-30

Ghost In The Ppl Part 1: Byovdll

Use-After-FreeMemory corruptionLSA Protection bypass

Clément Labro (@itm4n) · - · 2024-09-02

3CX Phone System Local Privilege Escalation Vulnerability

Local Privilege EscalationArbitrary file read

Adam Crosser · 3CX · 2024-08-28

Null Byte on Steroids

Null-Byte injectionAccount takeoverPassword resetSQL injection

Omar (@0x0ld) · - · 2024-02-06

$4,998 Bounty Awarded and 100,000 WordPress Sites Protected Against Unauthenticated Remote Code Execution Vulnerability Patched in GiveWP WordPress Plugin

RCEPHP pop chainPHP object injectionSecurity code review 💰 4,998

Villu Orav (@villu164) · Wordfence · 2024-08-19

4 exploits, 1 bug: exploiting cve-2024-20017 4 different ways

RCEBuffer OverflowMemory corruption

hyper (@hyprdude) · MediaTek · 2024-08-30

[$500] How I was able to give verification badge to any YouTube channel and bypass needed requirements

Parameter tampering 💰 500

Vojtech Cekal · Google (Youtube) · 2024-08-27

A Story About How I Found XSS in ASUS

XSS

Karthikeyan.V (@karthithehacker) · Asus · 2024-09-01

Bypassing airport security via SQL injection

SQL injection

Ian Carroll (@iangcarroll) · - · 2024-08-29

Double Agent: Exploiting Pass-through Authentication Credential Validation in Azure AD

CloudPrivilege escalationLateral movement

Ilan Kalendarov (@IKalendarov), Elad Beber · Microsoft (Entra ID / Azure AD) · 2024-08-15

SCCMSecrets.py: Exploiting SCCM Policies Distribution For Credentials Harvesting, Initial Access And Lateral Movement

Active DirectorySCCM

Quentin Roland (@croco_byte) · - · 2024-08-14

Self XSS + Login CSRF + OAuth = Account Takeover

Account takeoverOAuthLogin CSRFSelf-XSS

LS (@Loupreme_) · - · 2024-07-02

How I got $24000 Bounty from a Log4j RCE in Apple App Store.

RCEComponents with known vulnerabilities 💰 24,000

Mehar huzaifa (@Hunter_Huzaifa_) · Apple · 2024-08-25

Addressed AWS defaults risks: OIDC, Terraform and Anonymous to AdministratorAccess

CloudOIDCTerraformPrivilege escalation

Eduard Agavriloae (@saw_your_packet) · AWS · 2024-08-15

How I Got Bugs From Google Dorks

Information disclosure

Chandan das · - · 2024-08-25

How I can easily get four P1 at NASA using Simple Google Dorking.

Information disclosure

Francesco Topol / k4tedu · NASA · 2024-08-23

📝 Community Writeups

Full writeups unlock on each machine page after you root it

Shapeshifter A

by yods · 2026-11-03

Nightfall A

by yods · 2026-11-02

Bastion A

by yods · 2026-11-01

TokenSmith A

by yods · 2026-10-31

Bifrost B

by r3j3ct0r · 2026-10-26

Walkabout B

by r3j3ct0r · 2026-10-25

Driftsync B

by r3j3ct0r · 2026-10-24

Sidewinder B

by dong26 · 2026-10-24

Keyspace A

by fearlesssec · 2026-10-23

Keyspace A

by stratholme · 2026-10-23

Postmark A

by fearlesssec · 2026-10-23

Rootbase B

by r3j3ct0r · 2026-10-23

VAULTNET-WS01 A

by fearlesssec · 2026-10-23

VAULTNET-DB01 A

by fearlesssec · 2026-10-23

VAULTNET-DC01 A

by fearlesssec · 2026-10-23

Nightglass A

by fearlesssec · 2026-10-23

Threadbare A

by fearlesssec · 2026-10-23

Nightfall A

by fearlesssec · 2026-10-23

Bindforge B

by r3j3ct0r · 2026-10-23

Apex A

by r3j3ct0r · 2026-10-23

Bastion A

by fearlesssec · 2026-10-22

Sidewinder A

by fearlesssec · 2026-10-22

Postmark B

by r3j3ct0r · 2026-10-22

Keyspace A

by nullf4c710n · 2026-10-22

GridLock B

by r3j3ct0r · 2026-10-21

Nightfall A

by cypherme · 2026-10-21

Bastion A

by cypherme · 2026-10-21

Bootleak B

by r3j3ct0r · 2026-10-21

Retrogate B

by r3j3ct0r · 2026-10-20

Keyspace A

by kh3lm0n · 2026-10-18

💡 Latest Hints

Spoiler-safe nudges submitted by the community

MEGACORP-DC01 Enumeration

When you think there is nothing more to enumerate, remember there is still MEGACORP-WS01.

Bifrost Enumeration

The web page gave you one door. Doors tend to lead to more doors. Did you actually walk through everything?

Walkabout Privilege Escalation

With initial access established, hold off on exploits for a moment and check the fundamentals first — what actions is…

Driftsync Privilege Escalation

First question you should always whisper to a new shell: “what am I allowed to do that I shouldn’t be?” There’s one c…

Keyspace Privilege Escalation

Check which account the exposed service was started under. If it is running as the most privileged user, any file it …

Rootbase Foothold

When a database answers from the network, do not assume its highest level account is protected. A server handed down …

Loophole Enumeration

When a viewer will load any file you name, do not stop at system files like the user list. Aim it at the application'…

Postmark Privilege Escalation

Root does the same chore on a timer — the question isn’t what it runs, but what it trusts you to have left lying around.

GridLock Privilege Escalation

You’ve got a foothold as grid. Before reaching for exploits, ask the classic question: what am I allowed to do as ano…

Bootleak Post-Exploitation

First question you should always whisper to a new shell: “what am I allowed to do that I shouldn’t be?” There’s one c…

Retrogate Privilege Escalation

Before hunting for anything exotic, just ask the box what it already lets you do as someone more powerful. There’s a …

Meridian Hub Privilege Escalation

Ask two separate questions: what can I modify? and what runs on its own? The box falls where those two answers overlap.

Meridian Hub Enumeration

Check the permissions on scheduled maintenance scripts. If a root-owned task is writable by everyone, think about wha…

Blindspot Foothold

Look for the API Documentation. It'll gives you a clue :D

Driftsync Foothold

Having private key to a server meant no password needed to SSH into the server. You'll still need the username and po…

Walkabout Privilege Escalation

If the set-user-ID bit (S_ISUID) is set on an executable file, the effective user ID of the process created by execut…

Axferia Enumeration

Zone transfer works only if you know the domain name. A little help from chaos ought to do the trick,

DarkRat Privilege Escalation

You can run one helper as the superuser without typing a password, and it looks harmless. Read what that helper actua…

Bindforge Reconnaissance

Think about what a directory server can reveal before you authenticate

Container Caps Privilege Escalation

Check every possible way to escalate from normal user to root, if the key under mat wont fit the lock try change the …

🆕 Newest Labs

Freshly launched machines

Broadscope Medium

launched 2026-11-08

Echo Easy

launched 2026-11-08

Lockpick Medium

launched 2026-11-08

Bounty Board Hard

launched 2026-11-08

Handoff Hard

Bastion Hard

launched 2026-08-29

Nightfall Hard

launched 2026-08-29

Sidewinder Medium

launched 2026-08-29

DeployStation Medium

RatSuite Hard

Switchgear Medium

Corp Headers Easy

launched 2026-08-08

🧭 Learning Paths

Guided tracks on the platform

🪲 Web & Bug Bounty

8 modules, 38 machines — recon to a real bounty programme.

🎯 OSCP Path

Exam-style Linux & Windows machines, full methodology.

🧭 CPTS Path

HTB-CPTS-aligned track from recon to AD.

📝 Pentest Reporting

Write and grade real pentest plans & reports.

⚡ Project Meridian

5-machine Linux privesc series inside SolarGate Energy.

📚 All Learning Paths

Browse every guided track on the platform.

🛠 Toolbox & References

Curated offensive-security resources

GTFOBins ↗Privesc

Unix binaries abused to bypass local restrictions.

LOLBAS ↗Privesc

Living-off-the-land binaries & scripts for Windows.

HackTricks ↗Reference

Encyclopedic pentest / CTF methodology.

PayloadsAllTheThings ↗Payloads

Payloads & bypasses for every common web bug class.

PortSwigger Web Security Academy ↗Learning

Free, hands-on web vuln labs.

OWASP Testing Guide ↗Reference

Structured web app testing methodology.

OWASP Cheat Sheet Series ↗Reference

Concise defensive + offensive cheat sheets.

HackerOne Hacktivity ↗Reports

Publicly disclosed bug bounty reports.

revshells.com ↗Tooling

Reverse shell generator for every language/listener.

CyberChef ↗Tooling

Encode/decode/crypto swiss-army knife.