$ nmap -sV 192.168.1.0/24 PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https $ sqlmap -u http://target/id=1 [*] testing connection [*] checking stability Parameter: id (GET) Type: boolean-based blind $ msfconsole -q msf6 > use exploit/ms17_010 msf6 > set RHOSTS 10.0.0.5 msf6 > exploit [*] Meterpreter session 1 $ gobuster dir -u target.com /admin [200] /login [200] /backup [403] $ nikto -h target.com + Server: Apache/2.4.18 + XSS: header not set + SQLi possible $ hydra -l admin -P rockyou.txt [22][ssh] host: 10.0.0.1 login: admin pass: password123 $ python3 reverse_shell.py Listening on 0.0.0.0:4444 Connection received $ whoami root $ id uid=0(root) gid=0

← back to portfolio

Writeups & Research

CVE research, CTF walkthroughs, bug bounty disclosures, and notes from the trenches of offensive security.

All CVE Research CTF Writeup Bug Bounty Red Teaming Tools & Techniques Penetration Testing

// TAG: API SECURITY (1)

HTB
Fortress

Intermediate

API Security BOLA Command Injection

HackTheBox – Fortress: Chaining API Vulnerabilities to Admin RCE

Mass assignment + BOLA + command injection chain resulting in full server compromise.

Mar 12, 2026 · 10–12 min read