Linux Privesc systemd Security: Unit Sandboxing and Common Misconfigurations
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Linux
Linux Privesc 
Linux Privesc Ambient and Inheritable Linux Capabilities Explained
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Tools & Defense Linux auditd: Configuration and Threat Hunting
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Linux Privesc Linux Persistence: systemd Timers, udev Rules, and PAM Modules
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Linux Privesc SELinux and AppArmor: Enforcement Models and Misconfigurations
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Linux Privesc eBPF for Security Monitoring and Its Abuse Potential
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Windows Privesc Windows Subsystem for Linux (WSL) as an Attack Surface
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Containers & DevSecOps Linux Namespaces and cgroups: The Building Blocks of Containers
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Tools & Defense Linux Forensics: Triage and Artifact Collection
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Linux Privesc Exploiting SUID/SGID Binaries for Linux Privilege Escalation
How attackers abuse SUID/SGID binaries to escalate to root on Linux, plus blue-team detection and hardening.
Linux Privesc Exploiting sudo Misconfigurations with GTFOBins
How attackers turn weak sudo rules, NOPASSWD, env_keep, and LD_PRELOAD into root — and how blue teams shut it down.
Linux Privesc Abusing Linux Capabilities for Privilege Escalation
How attackers abuse cap_setuid and cap_dac_read_search file capabilities to escalate to root, and how blue teams detect it.
Linux Privesc Privilege Escalation via Cron Job Abuse on Linux
Exploit writable cron scripts, weak PATH, and wildcard injection to escalate to root, plus blue-team detection and hardening.
Linux Privesc PATH Hijacking: Privilege Escalation via Writable PATH Directories and Relative Binaries
How attackers abuse relative paths and writable PATH directories to plant malicious binaries and escalate privileges on Linux.
Linux Privesc Abusing NFS no_root_squash for Local Privilege Escalation
How a misconfigured NFS export with no_root_squash lets a low-priv user plant a root SUID binary and escalate.
Linux Privesc Abusing a World-Writable /etc/passwd for Root
How a writable /etc/passwd or /etc/shadow leads to instant root, with PoC and Blue Team defenses.
Linux Privesc Kernel Exploits Deep Dive: Dirty COW and Dirty Pipe
A practical look at CVE-2016-5195 (Dirty COW) and CVE-2022-0847 (Dirty Pipe): how they work, PoCs, and defenses.
Linux Privesc Privilege Escalation via the Docker Group: From User to Root
How membership in the docker group is equivalent to root, with PoCs for volume mounts and privileged containers, plus detection.
Linux Privesc Abusing LD_PRELOAD and LD_LIBRARY_PATH for Linux Privilege Escalation
How attackers weaponize sudo env_keep with LD_PRELOAD/LD_LIBRARY_PATH to escalate to root, and how blue teams stop it.
Linux Privesc Wildcard Injection: Privilege Escalation via tar and rsync in Cron Jobs
Abuse shell wildcard expansion in tar and rsync backup jobs to inject arguments and escalate to root on Linux.
Linux Privesc Abusing systemd Services and Timers for Linux Privilege Escalation
How writable unit files, ExecStart hijacks, and timer abuse turn a foothold into root on systemd Linux hosts.
Linux Privesc SSH Key Hunting and Lateral Movement on Linux
Find SSH private keys, abuse authorized_keys and known_hosts, and pivot via agent forwarding across Linux hosts.
Linux Privesc Credential Hunting on Linux: From .bash_history to Config Files
A practical guide to hunting cleartext credentials on Linux hosts via history files, config files, and grep, plus defenses.
Linux Privesc Baron Samedit: Exploiting the sudo Heap Overflow (CVE-2021-3156)
A practical walkthrough of Baron Samedit (CVE-2021-3156), the sudo heap overflow that yields local root, plus detection and defense.
Linux Privesc Linux Persistence Techniques: Maintaining Access After Initial Compromise
A practical tour of Linux persistence: authorized_keys, cron, systemd, rc.local, and ld.so.preload, plus detection.
Linux Privesc Linux Enumeration Cheat Sheet for Privilege Escalation
A practical Linux post-exploitation enumeration cheat sheet covering id, uname -a, sudo -l, SUID hunting, and process inspection.
Tools & Defense Breaking Out: A Practical Guide to Linux Container Escape Techniques
How privileged containers, host mounts, cgroups, and CAP_SYS_ADMIN lead to container escape, plus blue-team defenses.
RE & Pwn Writing Exploits with pwntools: From cyclic to ROP and shellcode
A practical guide to building Linux binary exploits with pwntools: cyclic offsets, ELF parsing, p64, ROP, and shellcraft.
Vulnlab Vulnlab Data Walkthrough by Yunolay (LFI with path traversal, Docker privileged user)
OverviewData (Solo, Linux)Junior Level Linux MachineYou will learn about getting a foothold through a CVE, cracking cust...
Vulnlab Vulnlab Sync Walkthrough by Yunolay (Rsync, Custom Hash Crack, Writable files executed by a privileged user)
OverviewSync (Solo, Linux)Junior Level Linux Machine.You will learn about exploiting custom applications & misconfigurat...