I post My Hackthebox writeups and other InfoSec findings here.https://spy0x7.vercel.app/en-ushttps://spy0x7.vercel.app/blog/what-is-edr-a-red-teamers-primer/https://spy0x7.vercel.app/blog/what-is-edr-a-red-teamers-primer/A practical, ground-up walkthrough of how modern EDRs see you on a Windows endpoint, the four detection engines they stack on top of that telemetry, and the honest map of bypass categories red teamers actually use in the field.Tue, 12 May 2026 00:00:00 GMThttps://spy0x7.vercel.app/blog/odata-ssrf-fun-filter-injection/https://spy0x7.vercel.app/blog/odata-ssrf-fun-filter-injection/Exploiting OData filter injection and SSRF via custom proxy headers in a financial platform.Sun, 25 May 2025 00:00:00 GMThttps://spy0x7.vercel.app/blog/proving-grounds-clamav/https://spy0x7.vercel.app/blog/proving-grounds-clamav/A walkthrough of exploiting CVE-2007-4560 on Offensive Security’s ClamAV Proving Grounds machine, resulting in remote root shell access via vulnerable Sendmail configuration.Sun, 27 Oct 2024 00:00:00 GMThttps://spy0x7.vercel.app/blog/how-i-found-sqli-in-20-minutes/https://spy0x7.vercel.app/blog/how-i-found-sqli-in-20-minutes/A fast-paced breakdown of how I discovered a critical SQL injection vulnerability in just 20 minutes during a pentest engagement.Tue, 21 Nov 2023 00:00:00 GMThttps://spy0x7.vercel.app/blog/easylfi/https://spy0x7.vercel.app/blog/easylfi/A crafty web challenge solved by bypassing both path traversal protections and a WAF using curl globbing and a quirky Flask template engine. The goal? Steal the flag from /flag.txt using LFI.Sat, 15 Oct 2022 00:00:00 GMThttps://spy0x7.vercel.app/blog/active-directory-resources/https://spy0x7.vercel.app/blog/active-directory-resources/A comprehensive reference collection of tools, techniques, links, and cheat sheets for Active Directory security assessment, attack simulation, defense, and detection.Thu, 23 Jun 2022 00:00:00 GMThttps://spy0x7.vercel.app/blog/hackthebox-routerspace-writeup/https://spy0x7.vercel.app/blog/hackthebox-routerspace-writeup/Hackthebox release new machine called routerspace, in this machine we get the apk file on port 80 after analyzing the apk we get a new endpoint which is vulnerable with rce and we get the shell through that rce and for privilege escalation the sudo version is vulnerable through a very famous CVE-2021-3156.Sat, 05 Mar 2022 00:00:00 GMThttps://spy0x7.vercel.app/blog/tryhackme-archangel/https://spy0x7.vercel.app/blog/tryhackme-archangel/This box explores a Local File Inclusion vulnerability leading to log poisoning and reverse shell access, privilege escalation through writable cron jobs, and finally root access via a PATH variable exploitation on a setuid binary.Thu, 09 Sep 2021 00:00:00 GMThttps://spy0x7.vercel.app/blog/hackthebox-seal-writeup/https://spy0x7.vercel.app/blog/hackthebox-seal-writeup/A full walkthrough of HackTheBox’s Seal machine, where I exploited GitBucket misconfigurations and bypassed Tomcat upload filters to gain root access via Ansible privilege escalation.Wed, 04 Aug 2021 00:00:00 GMThttps://spy0x7.vercel.app/blog/hackthebox-omni-writeup/https://spy0x7.vercel.app/blog/hackthebox-omni-writeup/Exploiting SirepRAT to gain SYSTEM shell on a Windows IoT Core box via unauthenticated RCE and credential leakage.Mon, 02 Aug 2021 00:00:00 GMThttps://spy0x7.vercel.app/blog/hackthebox-laboratory-writeup/https://spy0x7.vercel.app/blog/hackthebox-laboratory-writeup/This write-up covers the HackTheBox machine 'Laboratory', exploiting GitLab CE 12.8.1 to achieve LFI, arbitrary file read, and ultimately RCE through a deserialization bug, followed by Docker escape and SUID abuse for root access.Sat, 24 Apr 2021 00:00:00 GMThttps://spy0x7.vercel.app/blog/hackthebox-cache-writeup/https://spy0x7.vercel.app/blog/hackthebox-cache-writeup/This write-up walks through exploiting a vulnerable OpenEMR instance on HTB's Cache machine via SQL injection, gaining initial access, and escalating privileges through Docker group abuse and memcached enumeration.Fri, 16 Oct 2020 00:00:00 GMThttps://spy0x7.vercel.app/blog/from-xxe-oob-to-ntlm-thief/https://spy0x7.vercel.app/blog/from-xxe-oob-to-ntlm-thief/This writeup demonstrates how a blind XXE vulnerability can be chained to extract local files, perform internal port scanning, and steal NTLM hashes via SMB in a real-world API scenario.Thu, 20 Aug 2020 00:00:00 GMThttps://spy0x7.vercel.app/blog/hackthebox-safe/https://spy0x7.vercel.app/blog/hackthebox-safe/This writeup demonstrates how to exploit a buffer overflow in a custom binary service running on port 1337, bypassing stack protections using ROP, and ultimately gaining root through cracking a KeePass database.Thu, 19 Mar 2020 00:00:00 GMT