darkbb
✦ Legend ✦
Online
...
Activity
85 active days in the last yearRank Progress
✦ Legend ✦
Max Rank
Achievements
Streak Starter
Streak Master
Streak Legend
Lab Rat
Lab Expert
Lab Master
Scholar
Top 10
Pro Member
PHP2ShellCVE-2026-109618Memory DisclosureInformation Disclosuresession.upload_progressSession HijackingRemote Code ExecutionPrivilege EscalationPHP SecurityPenetration TestingAPI SecurityWeb HackingLogic FlawsToken ManipulationBase64 EncodingAuthorization BypassNetwork ReconnaissanceService DiscoveryDatabase ForensicsData EncodingCLI UsageData RecoveryIncident ResponseBase64Hex EncodingRedisJenkinsCI/CDDevOpsWeb SecurityPentestAutomationSession ManagementAuthenticationPHPLFIPassword CrackingAuthentication BypassDirectory TraversalPath ManipulationFile InclusionFlaskDebug ModePythonMemory AnalysisPath TraversalCGIFile AccessInput ValidationLogic FlawParameter ManipulationCommand InjectionWeb ExploitationNetwork SecuritySQL InjectionDatabase SecurityJWTToken AuthenticationCryptographyAlgorithm ConfusionRS256HS256Token ForgeryXXEXML SecurityFile DisclosureExternal EntityVulnerability AssessmentClaims ManipulationTime-Based AttacksSignature CrackingXSSCross-Site ScriptingStored XSSJavaScriptClient-Side SecurityDOM ManipulationCSRFCross-Site Request ForgerySession SecuritySocial EngineeringForm SecurityHTTP SecurityState ManagementSSRFServer-Side Request ForgeryAWS MetadataCloud SecurityIAM CredentialsAWS EC2Local File InclusionUser-Agent Log PoisoningApache SecuritySystem AdministrationLog AnalysisFile UploadBypass TechniquesWeb ShellsPost ExploitationCustom WordlistWordlist GenerationPRINCE ModeJohn the Ripperzip2johnMD5Hash CrackingOSINTPassword ReuseShell CommandsHTTP Parameter ManipulationSecurity AssessmentServer-Side Template InjectionJinja2Flask SecurityWeb Application TestingCode InjectionPython PickleEnterprise DeserializationCorporate Backup SystemsDisaster Recovery ExploitationConfiguration Import AttacksEnterprise SecurityHTTP HeadersIP SpoofingAccess Control BypassInformation GatheringJinja2 ExploitationLDAP InjectionDirectory ServicesCRLF InjectionRedis Command InjectionCache PoisoningProtocol ManipulationCookie ManipulationSUID BinariesLinux SecurityBinary ExploitationNoSQL InjectionMongoDBDocument DatabasesBlind SQLiTime-based SQLiBoolean-based SQLiDatabase EnumerationVisibility ControlsSecurity TestingOperator ExploitationGit ForensicsVersion Control SecurityRepository AnalysisSecret RecoveryPDF SecurityDictionary AttacksDigital ForensicsDocument SecurityBrute Force AttacksDocker Registry APIContainer SecurityAPI ManipulationRegistry ExploitationGraphQLSchema IntrospectionInjectionBrowser DevToolsFilter BypassApache AuthenticationDirectory EnumerationWeb ReconnaissanceAdministrative Panel DiscoveryWeb DevelopmentHexadecimalSteganographyImage AnalysisWebCTF BasicsNetwork AnalysisPacket CaptureWiresharkProtocol AnalysisRainbow TablesBinary AnalysisHex EditorsData StructuresReverse EngineeringFile AnalysisWeb InspectionHTML AnalysisQR Code AnalysisData ExtractionCryptanalysisClassical CryptoPattern RecognitionMemory ForensicsTool UsageROT13 EncodingFile DiscoveryCommand Line ToolsForensicsHTTP ProtocolAttack DetectionBlockchain AnalysisBitcoinOP_RETURNHex DecodingForensic AnalysisPDF ForensicsMetadataHidden DataForensic ToolsLSBAudio AnalysisTransposition CipherRail FenceKeePass 4.x SecurityDirect Brute ForcePassword Manager AssessmentModern CryptographySecurity Tool LimitationsDNSPacket AnalysisData ExfiltrationBase64 DecodingZIP Password CrackingfcrackzipBrute ForceArchive SecurityMD5 CrackingSource Code AnalysisWeb Application SecurityPassword AttacksClassical CiphersHistorical CryptanalysisWiFi SecurityWPA CrackingWireless Penetration TestingWindows RegistryPersistence AnalysisMalware AnalysisWireless SecurityWEP CrackingRC4 AnalysisCryptographic AttacksLegacy Protocol ExploitationFrequency AnalysisSecurity BypassClient-Side ManipulationIDORRace ConditionsTiming AttacksConcurrent ExploitationWebDAV ExploitationRemote File AccessHTTP MethodsWeb Server SecurityFile System EnumerationYAML DeserializationPyYAML ExploitationConfiguration InjectionPython SecurityUnsafe DeserializationFile Processing SecurityPath InjectionFile System SecurityURL ManipulationInternal Network AccessProtocol BypassPrompt InjectionLLM SecurityAI Red TeamingJailbreakOWASP LLM Top 10Guardrail BypassSystem Prompt LeakageExcessive AgencyNetwork ForensicsDNS AnalysisTraffic AnalysisDeobfuscationCode AnalysisEmail ForensicsHeader AnalysisPhishing DetectionDigital InvestigationPolyalphabetic CiphersRequest SmugglingPrototype PollutionNode.js SecurityJavaScript ExploitationObject ManipulationInput Validation BypassModern Web VulnerabilitiesType JugglingHash AnalysisGitVersion ControlReconnaissanceWeb EnumerationPassword AnalysisSecurity ToolsRegex BypassSQLiteUNION-Based SQLiOffice SecurityHash ExtractionHashcatWindows SecurityNTLMhashcatCSSMedia QueriesWeb ForensicsSource AnalysisDevToolsUnicodeText AnalysisLinuxCommand LineFile System NavigationHidden FilesgrepfindFile Upload BypassWeb Shell ExploitationOAuth 2.0Web ReconConfiguration ExploitsSSHSudoLinux CapabilitiesReverse ShellSystem EnumerationAdvanced ReconnaissanceAndroid Reverse EngineeringSCADA ExploitationCVE ExploitationFilter EvasionXORKnown-Plaintext AttackFTP ExploitationBackdoor DetectionNetwork ServicesRemote ShellSystem ExploitationIDOR ExploitationZip Slip VulnerabilityInternal Service DiscoveryBackup Service ExploitationSudo Vim ExploitationFile EnumerationCron JobsConfiguration AnalysisWPJWT ManipulationSSH ExploitationLog InjectionMass AssignmentLinux Privilege EscalationDirectory FuzzingX-Forwarded-For SpoofingBruteforceffufNewline InjectionLinux EnumerationSUID ExploitationBuffer OverflowARM64 ROPStatic Binary AnalysispwntoolsropperGDBSSTISSH Brute ForceApache TomcatWAR DeploymentDefault CredentialsMYSQLIRCECloud Penetration TestingAWS IMDSIMDSv2IAM Credential TheftMetadata Service AbuseAPI EnumerationGITHeadless CMSRevision HistoryToken AbuseWEBCrackmeKeygenobjdumpELFARM64 AssemblyStatic AnalysisGhidraHost Header InjectionPassword Reset PoisoningPickle DeserializationFile PermissionsAccess ControlIP SPOOFINGFTPCookie PoisoningSession TamperingSecurity Through ObscurityView SourceBroken Access ControlHTMLNmapNmap CommandsTelnetPort ScanningView Source CodeBroken AuthenticationDeveloper ToolsLearning PathCapture The FlagCTFFlag SubmissionUUIDGetting StartedCyber Security Fundamentals
API Breaker
Challenge
Red is Dead
Challenge
Snapchat Exposed
Challenge
Session Switch
Challenge
Corporate Breach
Challenge
Corporate Breach 2
Challenge
Flask Error
Challenge
Path Traversal
Challenge
API Logic Flaw
Challenge
Ping Pwn
Challenge
Auth Bypass
Challenge
JWT Bypass
Challenge
JWT Algo Confusion
Challenge
XXE Exposed
Challenge
JWT Claims Manipulation
Challenge
XSS Playground
Challenge
CSRF Bank Transfer
Challenge
URL Scanner
Challenge
LFI Log Poison
Challenge
File Upload Bypass
Challenge
Shell Command Scanner
Challenge
Template Injection
Challenge
Corporate Backup Deserializer
Challenge
IP Spoofing Admin
Challenge
Template Injector
Challenge
LDAP Injector
Challenge
Redis Cache Poisoner
Challenge
Cookie Forge
Challenge
SUID Privilege Hunter
Challenge
MongoDB Injector
Challenge
SQL Injection
Challenge
NoSQL Injection
Challenge
Git Secrets Hunter
Challenge
PDF Password Cracker
Challenge
Registry Hijacker
Challenge
GraphQL Gateway
Challenge
Button Activator
Challenge
File Include Bypass
Challenge
Corporate Directory Hunt
Challenge
Hex Hunt
Challenge
Stego Hunt
Challenge
Packet Pursuit
Easy
Get the Password
Challenge
Binary Secrets
Challenge
Base64 Detective
Challenge
QR Code Quest
Challenge
Crypto Cipher
Challenge
Memory Forensics
Challenge
Log Hunter
Challenge
Blockchain Secrets
Challenge
PDF Trap
Challenge
Pixel Puzzler
Challenge
Sonic Cipher
Challenge
Rail Fence
Challenge
KeePass Breaker
Challenge
DNS Exfil
Challenge
ZIP Cracker
Challenge
Admin Portal Breach
Challenge
Book Cipher Challenge
Challenge
WiFi Password Cracker
Challenge
Registry Hunter
Challenge
WEP Cracker
Challenge
Caesar Shift Decoder
Challenge
Header Hijacker
Challenge
IDOR Explorer
Challenge
Race Condition Hunter
Challenge
WebDAV Explorer
Challenge
YAML Bomb
Challenge
Simple Directory Traversal
Challenge
SQL Injection Test
Challenge
SSRF Validator
Challenge
DNS Tunneling Detective
Challenge
Hack This Site
Challenge
Email Header Forensics
Challenge
Vigenere Stego Hunt
Challenge
HTTP Smuggling
Challenge
Prototype Pollution Hunter
Challenge
Type Juggling Bypass
Challenge
Git Exposed
Challenge
Backup Hunter
Challenge
Crack SHA1 Hash
Challenge
Regex Bypass to SQLi
Challenge
Office Password Cracker
Challenge
Windows Password Cracker
Challenge
Shadow Cracker
Challenge
Fine Print
Challenge
Phantom Text
Challenge
Linux Fundamentals Practice
Challenge
FiPloit
Easy
Token Trust
Challenge
Matsudo
Medium
Internal
Hard
Compromised 2
Hard
RCE Playground
Medium
XOR Reuse
Challenge
Anonymous 2
Easy
Broken Chain
Hard
Scheduled Sabotage
Easy
WP Ultimate
Hard
Infiltrator
Easy
Hack the Box
Hard
FortiPy
Hard
Compromised 1
Medium
Query Quake
Medium
Traversed
Medium
AlVault
Medium
Beyond Echo
Medium
Host Hijack
Medium
TechNova Infiltration
Medium
Pickle Jar
Medium
Alpwned
Medium
Hidden CMS Breach
Medium
ClearDesk
Medium
Cronpocalypse
Easy
Spoof!
Easy
Anonymous
Easy
Include me
Easy
Hack the Cookie: Cookie Poisoning Attack
Very Easy
Hack the Login
Very Easy
Appended data and carving
Steganography foundations
Metadata and EXIF secrets
Steghide and passphrase cracking
LSB image steganography
YARA and Sigma detections
Threat hunting foundations
MITRE ATT&CK hunting
Threat intelligence fundamentals
The hunt program
IOCs, feeds and platforms
Endpoint and network hunting
The hunt loop
Daily Hack Solved
- The key the heap kept
+10 XP
1 hour ago
Flag Found
- PHP2Shell: Exploit PHP's Upload-Progress Memory Leak (CVE-2026-109618)
+350 XP
1 hour ago
Flag Found
- PHP2Shell: Exploit PHP's Upload-Progress Memory Leak (CVE-2026-109618)
+350 XP
1 hour ago
Streak Frozen
1 day ago
Daily Hack Solved
- The field the error named
+10 XP
1 day ago
Daily Hack Solved
- The analytics script nobody added
+10 XP
2 days ago
Daily Hack Solved
- The name that ran
+10 XP
4 days ago
Daily Hack Solved
- Deleted in the last layer
+10 XP
5 days ago
Daily Hack Solved
- Two logins too far apart
+10 XP
5 days ago
Daily Hack Solved
- The key that poisoned the base
+10 XP
6 days ago
Daily Hack Solved
- The origin it trusted
+10 XP
1 week ago
Daily Hack Solved
- The current that spelled it out
+10 XP
1 week ago
Daily Hack Solved
- Who really called
+10 XP
1 week ago
Daily Hack Solved
- The name that points nowhere
+10 XP
1 week ago
Daily Hack Solved
- The folder that shipped itself
+10 XP
1 week ago
Daily Hack Solved
- One password, many doors
+10 XP
1 week ago
Daily Hack Solved
- The redaction that was a layer
+10 XP
1 week ago
Daily Hack Solved
- The role any repo can wear
+10 XP
2 weeks ago
Daily Hack Solved
- The note inside the tool
+10 XP
2 weeks ago
Daily Hack Solved
- The cookie that was an object
+10 XP
2 weeks ago
Daily Hack Solved
- The redirect it only half checked
+10 XP
2 weeks ago
Daily Hack Solved
- The filename that runs
+10 XP
2 weeks ago
Daily Hack Solved
- The header that skips the check
+10 XP
2 weeks ago
Daily Hack Solved
- The codes the page had to know
+10 XP
3 weeks ago
Daily Hack Solved
- The word you already know
+10 XP
3 weeks ago
Daily Hack Solved
- The claim inside the claim
+10 XP
3 weeks ago
Streak Frozen
3 weeks ago
Streak Frozen
3 weeks ago
Daily Hack Solved
- The second factor in the backup
+10 XP
3 weeks ago
Daily Hack Solved
- The header that says where you are
+10 XP
3 weeks ago
Daily Hack Solved
- After the last byte
+10 XP
3 weeks ago
Daily Hack Solved
- Every road leads there
+10 XP
4 weeks ago
Flag Found
- API Breaker
+50 XP
4 weeks ago
Flag Found
- Red is Dead
+50 XP
4 weeks ago
Flag Found
- Snapchat Exposed
+50 XP
4 weeks ago
Flag Found
- Session Switch
+50 XP
4 weeks ago
Flag Found
- Corporate Breach
+50 XP
4 weeks ago
Flag Found
- Corporate Breach 2
+50 XP
4 weeks ago
Flag Found
- Flask Error
+50 XP
4 weeks ago
Flag Found
- Path Traversal
+50 XP
4 weeks ago
Flag Found
- API Logic Flaw
+50 XP
4 weeks ago
Flag Found
- Ping Pwn
+50 XP
4 weeks ago
Daily Hack Solved
- Instructions in the wiki
+10 XP
4 weeks ago
Active for 1 days
4 weeks ago
Flag Found
- Auth Bypass
+50 XP
1 month ago
Flag Found
- JWT Bypass
+50 XP
1 month ago
Flag Found
- JWT Algo Confusion
+50 XP
1 month ago
Lesson Completed
+10 XP
1 month ago
Flag Found
- XXE Exposed
+50 XP
1 month ago
Daily Hack Solved
- Write it back
+10 XP
1 month ago