Classroom

CTF walkthroughs, malware analysis, penetration testing, and security research by Animesh Roy.

TryHackMe Mayhem: Havoc C2 PCAP forensics with AES-256-CTR decryption

Havoc C2

Mayhem: Havoc C2 PCAP forensics with AES-256-CTR decryption

TryHackMe Source Code Review PHP: XXE to deserialization RCE

PHP

Source Code Review PHP: XXE to deserialization RCE

TryHackMe Web Frameworks .NET: ViewState RCE to Json.NET deser chain

ASP.NET

Web Frameworks .NET: ViewState RCE to Json.NET deser chain

TryHackMe Web Frameworks Python: Django leak to Flask session forgery

Django

Web Frameworks Python: Django leak to Flask session forgery

TryHackMe Web Frameworks Java: Spring actuator to deserialization RCE

Spring Boot

Web Frameworks Java: Spring actuator to deserialization RCE

TryHackMe Web Frameworks Code Review: source-to-sink Flask audit

code review

Web Frameworks Code Review: source-to-sink Flask audit

TryHackMe El Bandito: H2.CL desync to steal bot credentials

HTTP request smuggling

El Bandito: H2.CL desync to steal bot credentials

TryHackMe HTTP Browser Desync: client-side smuggling via Werkzeug

HTTP request smuggling

HTTP Browser Desync: client-side smuggling via Werkzeug

TryHackMe WebSocket Request Smuggling: proxy bypass via fake upgrades

WebSocket smuggling

WebSocket Request Smuggling: proxy bypass via fake upgrades

TryHackMe HTTP/2 Request Smuggling: CRLF injection and cache poisoning

HTTP/2

HTTP/2 Request Smuggling: CRLF injection and cache poisoning