YPYogeshwar Peelainexploitnotes.hashnode.dev·11h ago · 7 min readTryHackMe : CryptoCabana WriteupOverview CryptoCabana is a fake crypto-backup service hosted as an Azure Static Website. The attack path chains together four separate misconfigurations: A low-privilege Azure user with only Reader o00
YPYogeshwar Peelainexploitnotes.hashnode.dev·13h ago · 6 min readTryHackMe : Towel on the Sunbed WriteupTL;DR Ponzi Portfolio is a Node.js/Express "staking rewards" web app with a 24-hour cooldown on claiming a reward. The /claim endpoint has a classic check-then-act race condition: it checks whether th00
YPYogeshwar Peelainexploitnotes.hashnode.dev·16h ago · 8 min readTryHackMe : Do Not Disturb WriteupTL;DR Byte Lotus Poolside is a Node.js/Express booking app. A NoSQL injection in the login endpoint bypasses authentication entirely and lands directly in the staff role. The staff console's booking-c00
YPYogeshwar Peelainexploitnotes.hashnode.dev·23h ago · 5 min readTryHackMe : Overheard at BreakfastTL;DR A single artifact - a zipped screenshot of a Discord-style DM conversation is the entire challenge. Two "Byte Lotus Hotel" guests, Ponzi and Lambo!, chat about social media; Lambo! name-drops a00
YPYogeshwar Peelainexploitnotes.hashnode.dev·23h ago · 7 min readTryHackMe : Beach Bar WriteupTL;DR Beach Bar is a Flask-based "DJ booth" web app for a beach bar jukebox. Default demo credentials (dj/dj) left enabled in an HTML comment get you into the dashboard, which exposes a YAML playlist 00
