Classroom

CTF walkthroughs, malware analysis, penetration testing, and security research by Animesh Roy.

TryHackMe CAPTCHApocalypse: automated CAPTCHA brute-force

CAPTCHA bypass

CAPTCHApocalypse: automated CAPTCHA brute-force

TryHackMe Padding Oracles: AES-CBC byte-by-byte decryption

AES

Padding Oracles: AES-CBC byte-by-byte decryption

TryHackMe Attacking ECB Oracles: chosen-plaintext secret recovery

AES

Attacking ECB Oracles: chosen-plaintext secret recovery

TryHackMe Length Extension Attacks: SHA-256 forging and escalation

SHA-256

Length Extension Attacks: SHA-256 forging and escalation

TryHackMe Breaking Crypto the Simple Way: RSA to AES bit-flip

RSA

Breaking Crypto the Simple Way: RSA to AES bit-flip

TryHackMe Mayhem: Havoc C2 PCAP forensics with AES-256-CTR decryption

Havoc C2

Mayhem: Havoc C2 PCAP forensics with AES-256-CTR decryption

TryHackMe Source Code Review PHP: XXE to deserialization RCE

PHP

Source Code Review PHP: XXE to deserialization RCE

TryHackMe Web Frameworks .NET: ViewState RCE to Json.NET deser chain

ASP.NET

Web Frameworks .NET: ViewState RCE to Json.NET deser chain

TryHackMe Web Frameworks Python: Django leak to Flask session forgery

Django

Web Frameworks Python: Django leak to Flask session forgery

TryHackMe Web Frameworks Java: Spring actuator to deserialization RCE

Spring Boot

Web Frameworks Java: Spring actuator to deserialization RCE