Linux Privesc Abusing a World-Writable /etc/passwd for Root
How a writable /etc/passwd or /etc/shadow leads to instant root, with PoC and Blue Team defenses.
Yunolay
Linux Privesc 
Linux Privesc Kernel Exploits Deep Dive: Dirty COW and Dirty Pipe
A practical look at CVE-2016-5195 (Dirty COW) and CVE-2022-0847 (Dirty Pipe): how they work, PoCs, and defenses.
Linux Privesc Practical Linux Enumeration with LinPEAS
A hands-on guide to running LinPEAS for fast Linux privilege escalation enumeration, reading its output, and defending against it.
Linux Privesc Privilege Escalation via the Docker Group: From User to Root
How membership in the docker group is equivalent to root, with PoCs for volume mounts and privileged containers, plus detection.
Linux Privesc Abusing LD_PRELOAD and LD_LIBRARY_PATH for Linux Privilege Escalation
How attackers weaponize sudo env_keep with LD_PRELOAD/LD_LIBRARY_PATH to escalate to root, and how blue teams stop it.
Linux Privesc Wildcard Injection: Privilege Escalation via tar and rsync in Cron Jobs
Abuse shell wildcard expansion in tar and rsync backup jobs to inject arguments and escalate to root on Linux.
Linux Privesc Abusing systemd Services and Timers for Linux Privilege Escalation
How writable unit files, ExecStart hijacks, and timer abuse turn a foothold into root on systemd Linux hosts.
Linux Privesc SSH Key Hunting and Lateral Movement on Linux
Find SSH private keys, abuse authorized_keys and known_hosts, and pivot via agent forwarding across Linux hosts.
Linux Privesc Credential Hunting on Linux: From .bash_history to Config Files
A practical guide to hunting cleartext credentials on Linux hosts via history files, config files, and grep, plus defenses.
Linux Privesc Python Library Hijacking for Privilege Escalation on Linux
Abuse writable modules, PYTHONPATH, and sys.path ordering to hijack imports in privileged Python scripts and escalate to root.
Linux Privesc PwnKit: Local Root via polkit pkexec (CVE-2021-4034)
How CVE-2021-4034 (PwnKit) abuses pkexec argv handling and GCONV_PATH to get instant local root on Linux.
Linux Privesc Baron Samedit: Exploiting the sudo Heap Overflow (CVE-2021-3156)
A practical walkthrough of Baron Samedit (CVE-2021-3156), the sudo heap overflow that yields local root, plus detection and defense.
Linux Privesc Linux Persistence Techniques: Maintaining Access After Initial Compromise
A practical tour of Linux persistence: authorized_keys, cron, systemd, rc.local, and ld.so.preload, plus detection.
Linux Privesc Linux Enumeration Cheat Sheet for Privilege Escalation
A practical Linux post-exploitation enumeration cheat sheet covering id, uname -a, sudo -l, SUID hunting, and process inspection.
Web Exploitation SQL Injection: The Complete Guide to UNION and Error-Based Exploitation
A practical guide to UNION-based and error-based SQL injection, payload crafting with information_schema, and blue-team defenses.
Web Exploitation Blind SQL Injection: Boolean-Based and Time-Based Inference Techniques
A practical guide to blind SQL injection: boolean-based and time-based inference, SUBSTRING/SLEEP payloads, and blue-team defenses.
Web Exploitation SQLMap in Practice: From Detection to OS Shell
A practical SQLMap workflow covering request files, database enumeration, data dumping, OS shells, and WAF evasion with tamper scripts.
Web Exploitation Local File Inclusion (LFI) Fundamentals: Path Traversal, /etc/passwd, and Filter Bypasses
A practical introduction to Local File Inclusion: path traversal, reading /etc/passwd, null byte tricks, and PHP filter bypasses, plus defenses.
Security Remote File Inclusion (RFI) Fundamentals: From allow_url_include to RCE
Learn how Remote File Inclusion abuses PHP wrappers and allow_url_include to achieve remote code execution, plus blue-team defenses.
Web Exploitation From LFI to RCE: Practical Escalation Techniques
How to escalate a PHP Local File Inclusion into remote code execution via log poisoning, php://filter, data wrappers, sessions and /proc.
Web Exploitation SSRF Deep Dive: Pivoting to Cloud Metadata, Internal Scans, and Filter Bypass
A practical guide to Server-Side Request Forgery: cloud metadata theft, internal port scanning, filter bypass, and Blue Team defenses.
Web Exploitation XXE Attacks: Exploiting XML External Entities for File Disclosure and Blind OOB Exfiltration
A practical guide to XML External Entity attacks — DOCTYPE abuse, file disclosure, SSRF, blind/OOB exfiltration, and defense.
Web Exploitation Cross-Site Scripting (XSS): A Practical Primer
A hands-on primer on reflected, stored, and DOM-based XSS, cookie theft, and modern CSP bypass techniques.
Web Exploitation Insecure Deserialization: Exploiting PHP and Java Object Injection
How PHP unserialize and Java deserialization lead to RCE via magic methods and gadget chains, plus blue-team defenses.
Web Exploitation OS Command Injection: From Shell Metacharacters to Blind Exfiltration and Filter Bypass
A practical guide to OS command injection: shell metacharacters, blind techniques, IFS-based filter bypass, and blue-team defenses.
Web Exploitation Path Traversal: Escaping the Web Root with ../, Encoding Tricks, and Null Bytes
A practical guide to directory traversal: dot-dot-slash, encoding bypasses, absolute paths, null bytes, plus blue-team defenses.
Web Exploitation Exploiting File Upload Vulnerabilities: From Bypass to Webshell
A practical guide to bypassing file upload filters with double extensions, content-type, and magic bytes to land a webshell, plus defenses.
Web Exploitation JWT Vulnerabilities and Attacks: alg none, Key Confusion, and kid Injection
A practical guide to exploiting JSON Web Token flaws — alg=none, key confusion, weak secrets, and kid injection — plus defenses.
Web Exploitation IDOR and Broken Access Control: Exploiting Insecure Direct Object References
A practical guide to finding and exploiting IDOR/BOLA flaws through parameter tampering and enumeration, plus blue-team defenses.
Security Server-Side Template Injection: From {{7*7}} to RCE
A practical guide to Server-Side Template Injection: detecting, fingerprinting, and escaping Jinja2 and Twig sandboxes to achieve RCE.
Security Authentication Bypass Techniques: Logic Flaws, SQLi, Weak Resets, and 2FA Bypass
A practical walkthrough of four authentication bypass classes — logic flaws, SQLi, weak password resets, and 2FA bypass — with detection and defense.
Web Exploitation CSRF Attacks and Defenses: Forging State-Changing Requests
How Cross-Site Request Forgery hijacks authenticated sessions, with a hands-on PoC and modern token/SameSite defenses.
Web Exploitation Web Cache Poisoning: Weaponizing Unkeyed Input
How attackers turn unkeyed inputs like X-Forwarded-Host into stored XSS via shared caches, and how to defend.
Web Exploitation Attacking GraphQL APIs: Introspection, Batching, IDOR, and DoS
A practical guide to GraphQL pentesting: fingerprinting with graphw00f, introspection, batching, IDOR, and DoS, plus blue-team defenses.
Tools & Defense Nmap in Practice: A Pentester’s Guide to Scanning, NSE, and Timing
A practical, accurate Nmap workflow covering host discovery, -p-, -sC -sV, NSE scripts, and timing — plus blue-team detection.
Tools & Defense Burp Suite: A Practical Introduction for Web Application Testing
A hands-on guide to Burp Suite's proxy, Repeater, Intruder, Scanner, and extensions, plus blue-team defenses.
Tools & Defense Metasploit Framework Fundamentals: From msfconsole to Meterpreter
A practical introduction to the Metasploit Framework: searching modules, launching exploits, driving Meterpreter, and detecting it all.
Tools & Defense Mastering the Impacket Suite: From Lateral Movement to Credential Extraction
A practical tour of Impacket's psexec, wmiexec, secretsdump, GetUserSPNs and smbserver, plus blue-team detection.
Tools & Defense NetExec (CrackMapExec) in Practice: SMB Enumeration, SAM Dumping, and Password Spraying
A practical guide to NetExec (nxc) for SMB enumeration, SAM dumping, password spraying, and modules — plus blue-team detection.
Tools & Defense Password Cracking with Hashcat: Modes, Rules, Masks, and Cracking NTLM & Kerberos
A practical guide to Hashcat: hash modes, rule-based and mask attacks, and cracking NTLM and Kerberos hashes plus how to defend.