I'm 0x74shelby, a penetration tester and red teamer. This is where my CTF writeups and pentest case studies live.
Boxes rooted, methodology documented
Dual-machine white-box engagement. SNMP enumeration → IMAPS credential extraction → R-services lateral movement → SSH key exfiltration → root on both.
Virtual host enumeration → Jenkins default-cred RCE via Groovy console → XLSX hash cracking → rbash escape via vi → GTFObins scp to root.
OSINT recon → username-anarchy generation → Hydra FTP/SSH brute force → Sherlock Reddit OSINT → MySQL credential reuse → GTFObins sudo ftp → root.
Cybercrime history, malware case studies & tech fraud
A top 10 tech company admitted 6.5 million leaked passwords in 2012. Four years later, 117 million went on sale.
Sumit Gupta's small Delhi office quietly phished politicians, journalists, NGOs and hedge funds for seven years.
A criminal SaaS startup that franchised ransomware. Travelex, JBS, Kaseya, Quanta, Acer. Then the FBI caught up.
Concepts, methodology & technique write-ups
Domain structure, objects, trust relationships, Kerberos, LDAP, and why AD is the top attack target.
A systematic methodology: SUID binaries, cron abuse, writable /etc/passwd, LD_PRELOAD, and kernel exploits.
Authentication bypass, UNION-based extraction, blind injection, and escalating in-band SQLi to OS execution.
