HackIndex.io
Language
Showing 1–19 of 19
YAML deserialization flaw exploited via SnakeYAML to gain foothold, then abusing WASM/bash script path hijacking for privilege escalation on Linux.
Exploit OpenNetAdmin RCE to gain initial access, pivot through internal web configs for credentials, then escalate via nano GTFOBins sudo misconfiguration.
Exploit WordPress on a subdomain to gain RCE, leverage DNS zone transfer for recon, and abuse sudoers misconfiguration for root escalation.
Exploit a Minecraft server's exposed plugin JAR containing hardcoded credentials to gain SSH access and escalate to root via sudo misconfiguration.
Exploit Drupalgeddon2 RCE on a Drupal site, crack harvested MySQL creds, then abuse dirty_sock via snap for root escalation.
SQL injection on hotel booking site leads to RCE via SQLMap's file write. Escalate through command injection in a script and sudo abuse of systemctl.
Linear programming attack on a custom XOR-based encryption scheme to recover the flag by solving constraints derived from the cipher's operations.
Exploit a Linux machine by abusing misconfigured services and weak credentials to gain initial access, then escalate privileges through vulnerable SUID binaries.
Memory forensics challenge using Volatility to analyze a Linux memory dump, extracting artifacts to uncover hidden flags through process and file analysis.
Exploit a web app leaking user cohort data to enumerate valid credentials, then leverage misconfigured SSH access to escalate privileges on this easy Linux box.
Unauthenticated Next.js RCE via React2Shell (CVE-2025-55182), crack a reused hash from the app SQLite database for SSH, then abuse a root Node --inspect debug port for root.
SSTI via resume upload, exploiting a Flask/Jinja2 template injection in a smart hiring app to achieve RCE and capture the flag.
A writeup covering enumeration, initial access, lateral movement, and privilege escalation through misconfigurations and internal service abuse.
PHP type juggling vulnerability exploited via loose comparison to bypass authentication and gain RCE through crafted input manipulation on a Linux web challenge.
Exploit information disclosure on a Linux web challenge by enumerating exposed endpoints to uncover hidden facts and capture the flag.
Exploit a Pterodactyl game panel via subdomain enumeration, command injection, and privilege escalation to root on this medium Linux box.
Express.js app vulnerable to prototype pollution via query parameters, leading to RCE through crafted payloads to bypass filters and gain a shell.
Linux box exploiting Overleaf-based file upload vulnerability to gain RCE, then leveraging a misconfigured sudo privilege for root escalation.
Exploit a second-stage code execution challenge on Linux by analyzing decompiled logic, crafting input to bypass checks, and achieving shell access.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.