> h4ck0rman :: ~/
tutorials, walkthroughs, and writeups for builders who break things.
Tutorials, CTF walkthroughs, and notes on offensive security and dev infra by h4ck0rman. Watch the videos, follow the commands, build the muscle.
// featured
all tutorials →
intermediateoscp+ prep, hackthebox administrator speedrun
An end-to-end Active Directory speedrun on HackTheBox Administrator. ACL chaining from Olivia all the way to Domain Admin via GenericAll, ForceChangePassword, AS-REP roast, FTP creds, and a final DCSync.
// more tutorials
// labs
all →sql injection
0/3 liveUser input concatenated into SQL queries lets attackers exfiltrate, modify, or destroy data. Still in the OWASP Top 10 for a reason.
cross-site scripting
0/0 liveInject attacker-controlled JavaScript into a page another user views, and run as that user. Reflected, stored, and DOM-based variants.
cross-site request forgery
0/0 liveTrick a user's browser into sending an authenticated request the user never intended. SameSite cookies and CSRF tokens, until they aren't.
clickjacking
0/0 liveOverlay a transparent iframe of a target site on top of a decoy UI and harvest clicks meant for innocent buttons. UI redress, mouse hijack, drag and drop.
dom-based vulnerabilities
0/0 liveBugs that live entirely in client-side JavaScript. Sources flow into sinks without ever touching the server, and the server-side WAF doesn't see them.
cross-origin resource sharing
0/0 liveMisconfigured CORS turns the same-origin policy into a write-once permission to leak credentials. Reflected origins, null origin, wildcard pitfalls.
// youtube
watch every walkthrough on youtube.
Hands-on offensive security, OSCP+ prep, and live CTF play. New videos every few weeks. Subscribe so you do not miss the next one.
@h4ck0rman on youtube ↗