kevine
✦ Legend ✦
Online
Ranked #2 worldwide with 151 flags captured. I break things professionally, then explain how to fix them.
Activity
48 active days in the last year
Less
More
Rank Progress
✦ Legend ✦
Max Rank
Achievements
First Blood
Streak Starter
Streak Master
Streak Legend
Lab Rat
Lab Expert
Lab Master
Scholar
Top 10
SSRFCloud Penetration TestingAWS IMDSIMDSv2IAM Credential TheftPrivilege EscalationMetadata Service AbuseAPI EnumerationServer-Side Template InjectionFlask SecurityJinja2 ExploitationRemote Code ExecutionWeb SecurityLDAP InjectionAuthentication BypassDirectory ServicesEnterprise SecurityCRLF InjectionRedis Command InjectionCache PoisoningProtocol ManipulationNoSQL InjectionMongoDBDocument DatabasesSUID BinariesCommand InjectionLinux SecurityBinary ExploitationDocker Registry APIContainer SecurityAPI ManipulationRegistry ExploitationGraphQLAPI SecuritySchema IntrospectionAuthorization BypassInjectionJavaScriptBrowser DevToolsDOM ManipulationClient-Side SecurityJWTCookie ManipulationLocal File InclusionFilter BypassApache AuthenticationPassword CrackingDirectory EnumerationWeb ReconnaissanceAdministrative Panel DiscoverySecurity AssessmentHTTP HeadersSecurity BypassWeb Application SecurityClient-Side ManipulationCryptographyClassical CiphersFrequency AnalysisPattern RecognitionNetwork ForensicsDNS AnalysisData ExfiltrationTraffic AnalysisIDORParameter ManipulationVisibility ControlsAccess Control BypassSecurity TestingOperator ExploitationUser-Agent Log PoisoningDirectory TraversalApache SecuritySystem AdministrationLog AnalysisShell CommandsHTTP Parameter ManipulationPDF SecurityDictionary AttacksDigital ForensicsDocument SecurityBrute Force AttacksJinja2Web Application TestingCode InjectionKeePass 4.x SecurityDirect Brute ForcePassword Manager AssessmentModern CryptographySecurity Tool LimitationsZIP Password CrackingJohn the RipperfcrackzipBrute ForceArchive SecurityPython PickleEnterprise DeserializationCorporate Backup SystemsDisaster Recovery ExploitationConfiguration Import AttacksGit ForensicsVersion Control SecurityRepository AnalysisPenetration TestingSecret RecoveryOSINTMD5 CrackingSource Code AnalysisPassword AttacksHistorical CryptanalysisWiFi SecurityWPA CrackingWireless Penetration TestingNetwork SecurityPacket AnalysisWindows RegistryPersistence AnalysisBase64 DecodingIncident ResponseMalware AnalysisWireless SecurityWEP CrackingRC4 AnalysisCryptographic AttacksLegacy Protocol ExploitationIP SpoofingInformation GatheringFlaskDebug ModePythonMemory AnalysisLogic FlawPHPWeb ExploitationService DiscoveryToken AuthenticationAlgorithm ConfusionRS256HS256Token ForgeryXXEXML SecurityFile DisclosureExternal EntityVulnerability AssessmentSQL InjectionDatabase SecurityBlind SQLiTime-based SQLiBoolean-based SQLiDatabase EnumerationClaims ManipulationTime-Based AttacksSignature CrackingXSSCross-Site ScriptingStored XSSSession HijackingServer-Side Request ForgeryAWS MetadataCloud SecurityIAM CredentialsAWS EC2File UploadBypass TechniquesWeb ShellsInput ValidationSocial EngineeringPost ExploitationQR Code AnalysisImage AnalysisData ExtractionSteganographyWeb HackingLogic FlawsToken ManipulationBase64 EncodingCryptanalysisClassical CryptoData EncodingMemory ForensicsBinary AnalysisTool UsageData RecoveryROT13 EncodingNetwork ReconnaissanceDatabase ForensicsCLI UsageBase64Hex EncodingRedisJenkinsCI/CDDevOpsPentestAutomationNetwork AnalysisDNSLFIPath ManipulationFile InclusionBlockchain AnalysisBitcoinOP_RETURNHex DecodingForensic AnalysisPDF ForensicsFile AnalysisMetadataHidden DataForensic ToolsLSBForensicsAudio AnalysisTransposition CipherRail FenceWeb InspectionHTML AnalysisWeb DevelopmentHexadecimalWebCTF BasicsPacket CaptureWiresharkProtocol AnalysisMD5Rainbow TablesHex EditorsData StructuresReverse EngineeringWebDAV ExploitationRemote File AccessHTTP MethodsWeb Server SecurityFile System EnumerationYAML DeserializationPyYAML ExploitationConfiguration InjectionPython SecurityUnsafe DeserializationFile Processing SecurityPath InjectionFile System SecurityFile AccessURL ManipulationInternal Network AccessProtocol BypassRace ConditionsTiming AttacksConcurrent ExploitationPrototype PollutionNode.js SecurityJavaScript ExploitationObject ManipulationInput Validation BypassModern Web VulnerabilitiesPolyalphabetic CiphersEmail ForensicsHeader AnalysisPhishing DetectionDigital InvestigationLinuxCommand LineFile System NavigationHidden FilesgrepfindHTTP ProtocolRequest SmugglingHash CrackingPassword AnalysisSecurity ToolsType JugglingHash AnalysisWeb EnumerationFile DiscoveryReconnaissanceGitVersion ControlRegex BypassSQLiteUNION-Based SQLiOffice SecurityHash ExtractionHashcatWindows SecurityNTLMhashcatUnicodeWeb ForensicsText AnalysisCSSMedia QueriesSource AnalysisDevToolsOAuth 2.0Web ReconConfiguration ExploitsXORKnown-Plaintext AttackWPCSRFCross-Site Request ForgerySession SecurityForm SecurityHTTP SecurityState ManagementAdvanced ReconnaissanceAndroid Reverse EngineeringSCADA ExploitationCVE ExploitationIDOR ExploitationZip Slip VulnerabilityInternal Service DiscoveryBackup Service ExploitationSudo Vim ExploitationLinux CapabilitiesReverse ShellSystem EnumerationFilter EvasionFile Upload BypassPHP SecurityWeb Shell ExploitationJWT ManipulationSSH ExploitationLog InjectionSSHFile EnumerationCron JobsConfiguration AnalysisHeadless CMSInformation DisclosureRevision HistoryToken AbuseHost Header InjectionPassword Reset PoisoningMass AssignmentPassword ReuseLinux Privilege EscalationMYSQLIRCESSTISSH Brute ForceDirectory FuzzingX-Forwarded-For SpoofingBruteforceffufNewline InjectionLinux EnumerationSUID ExploitationBuffer OverflowARM64 ROPStatic Binary AnalysispwntoolsropperGDBCrackmeKeygenobjdumpELFARM64 AssemblyStatic AnalysisGhidraFile PermissionsApache TomcatWAR DeploymentDefault CredentialsSudoAuthenticationDeobfuscationCode AnalysisGITWEBPickle DeserializationPath TraversalAccess ControlSecurity Through ObscurityView SourceBroken Access ControlHTMLCommand Line ToolsAttack DetectionCGISession ManagementIP SPOOFINGFTP ExploitationBackdoor DetectionNetwork ServicesRemote ShellSystem ExploitationFTPView Source CodeCapture The FlagCTFFlag SubmissionUUIDGetting StartedCyber Security FundamentalsNmapNmap CommandsTelnetPort ScanningBroken AuthenticationDeveloper ToolsLearning PathCookie PoisoningSession Tampering
Template Injector
Challenge
LDAP Injector
Challenge
Redis Cache Poisoner
Challenge
MongoDB Injector
Challenge
SUID Privilege Hunter
Challenge
Registry Hijacker
Challenge
GraphQL Gateway
Challenge
Button Activator
Challenge
Cookie Forge
Challenge
File Include Bypass
Challenge
Corporate Directory Hunt
Challenge
Header Hijacker
Challenge
Caesar Shift Decoder
Challenge
DNS Tunneling Detective
Challenge
IDOR Explorer
Challenge
NoSQL Injection
Challenge
LFI Log Poison
Challenge
Shell Command Scanner
Challenge
PDF Password Cracker
Challenge
Template Injection
Challenge
KeePass Breaker
Challenge
ZIP Cracker
Challenge
Corporate Backup Deserializer
Challenge
Git Secrets Hunter
Challenge
Admin Portal Breach
Challenge
Book Cipher Challenge
Challenge
WiFi Password Cracker
Challenge
Registry Hunter
Challenge
WEP Cracker
Challenge
IP Spoofing Admin
Challenge
Flask Error
Challenge
API Logic Flaw
Challenge
Ping Pwn
Challenge
JWT Bypass
Challenge
JWT Algo Confusion
Challenge
XXE Exposed
Challenge
SQL Injection
Challenge
JWT Claims Manipulation
Challenge
XSS Playground
Challenge
URL Scanner
Challenge
File Upload Bypass
Challenge
QR Code Quest
Challenge
API Breaker
Challenge
Crypto Cipher
Challenge
Memory Forensics
Challenge
Red is Dead
Challenge
Snapchat Exposed
Challenge
DNS Exfil
Challenge
Corporate Breach
Challenge
Corporate Breach 2
Challenge
Blockchain Secrets
Challenge
PDF Trap
Challenge
Pixel Puzzler
Challenge
Sonic Cipher
Challenge
Rail Fence
Challenge
Base64 Detective
Challenge
Hex Hunt
Challenge
Stego Hunt
Challenge
Packet Pursuit
Challenge
Get the Password
Challenge
Binary Secrets
Challenge
WebDAV Explorer
Challenge
SQL Injection Test
Challenge
YAML Bomb
Challenge
Simple Directory Traversal
Challenge
SSRF Validator
Challenge
Race Condition Hunter
Challenge
Prototype Pollution Hunter
Challenge
Vigenere Stego Hunt
Challenge
Email Header Forensics
Challenge
Linux Fundamentals Practice
Challenge
HTTP Smuggling
Challenge
Crack SHA1 Hash
Challenge
Type Juggling Bypass
Challenge
Backup Hunter
Challenge
Git Exposed
Challenge
Regex Bypass to SQLi
Challenge
Office Password Cracker
Challenge
Windows Password Cracker
Challenge
Shadow Cracker
Challenge
Phantom Text
Challenge
Fine Print
Challenge
Token Trust
Challenge
XOR Reuse
Challenge
WP Ultimate
Hard
CSRF Bank Transfer
Challenge
Compromised 2
Hard
Broken Chain
Hard
Internal
Hard
RCE Playground
Medium
FiPloit
Easy
Infiltrator
Easy
Scheduled Sabotage
Easy
Host Hijack
Medium
Query Quake
Medium
FortiPy
Hard
Hack the Box
Hard
TechNova Infiltration
Medium
Alpwned
Medium
Compromised 1
Medium
Hidden CMS Breach
Medium
Hack This Site
Challenge
Traversed
Medium
AlVault
Medium
Pickle Jar
Medium
Auth Bypass
Challenge
ClearDesk
Medium
Log Hunter
Challenge
Path Traversal
Challenge
Beyond Echo
Medium
Session Switch
Challenge
Matsudo
Medium
Cronpocalypse
Easy
Spoof!
Easy
Include me
Easy
Anonymous 2
Easy
Anonymous
Easy
Hack the Login
Very Easy
Hack the Cookie: Cookie Poisoning Attack
Very Easy
Installing Nmap
Advanced Techniques
Introduction to Nmap
Essential Nmap Scanning
Remediate
Techniques for IP Spoofing in HTTP Headers
Manipulating Headers
Linux privesc fundamentals
PATH hijacking
Manual enumeration
Linux hardening
Cron job abuse
Container escapes
SUID exploitation
Automated enumeration
Sudo abuse
Kernel exploits
1. Legal & Compliance
2. Network Protocols and Security
4. Network Scanning
3. Reconnaissance
Course Summary
Web Security Intro
SOC fundamentals
Log analysis with queries
Log sources and SIEM
Shellshock (CVE-2014-6271)
RCE: Introduction
RCE in PHP
Daily Hack Solved
- Who got root
+10 XP
20 hours ago
Daily Hack Solved
- Read the system prompt
+10 XP
1 day ago
Daily Hack Solved
- Reverse then ROT
+10 XP
2 days ago
Daily Hack Solved
- ELF, not data
+10 XP
3 days ago
Daily Hack Solved
- Forge the group claim
+10 XP
4 days ago
Daily Hack Solved
- The webview endpoint
+10 XP
5 days ago
Daily Hack Solved
- Find the reentrancy bug
+10 XP
6 days ago
Daily Hack Solved
- Two layers, one flag
+10 XP
1 week ago
Daily Hack Solved
- SSRF to the internal KV store
+10 XP
1 week ago
Daily Hack Solved
- Open the app sandbox
+10 XP
1 week ago
Daily Hack Solved
- Find the SQLi probe
+10 XP
1 week ago
Daily Hack Solved
- Find the employer
+10 XP
1 week ago
Daily Hack Solved
- Decrypt the ransom note
+10 XP
1 week ago
Daily Hack Solved
- The token names the host
+10 XP
1 week ago
Daily Hack Solved
- Find the tool-exec RCE sink
+10 XP
2 weeks ago
Daily Hack Solved
- PNG, not TXT
+10 XP
2 weeks ago
Daily Hack Solved
- Find the hidden email
+10 XP
2 weeks ago
Daily Hack Solved
- Decode the beacon label
+10 XP
2 weeks ago
Daily Hack Solved
- SSRF the cloud metadata
+10 XP
2 weeks ago
Daily Hack Solved
- Loot the instance role
+10 XP
2 weeks ago
Flag Found
- SSRF Attack: Steal Cloud Metadata Credentials
+200 XP
2 weeks ago
Flag Found
- SSRF Attack: Steal Cloud Metadata Credentials
+200 XP
2 weeks ago
Daily Hack Solved
- Same handle everywhere
+10 XP
2 weeks ago
Daily Hack Solved
- CloudTrail anomaly
+10 XP
3 weeks ago
Daily Hack Solved
- Vigenere then base64
+10 XP
3 weeks ago
Daily Hack Solved
- Read the JWT claim
+10 XP
3 weeks ago
Daily Hack Solved
- Find the hardcoded API key
+10 XP
3 weeks ago
Daily Hack Solved
- The GPG blob
+10 XP
3 weeks ago
Daily Hack Solved
- Hex back to text
+10 XP
3 weeks ago
Daily Hack Solved
- The hidden link
+10 XP
3 weeks ago
Daily Hack Solved
- Flip the debug flag
+10 XP
4 weeks ago
Daily Hack Solved
- Read the shell history
+10 XP
4 weeks ago
Daily Hack Solved
- Geolocate the photo
+10 XP
4 weeks ago
Daily Hack Solved
- Trace the port scan
+10 XP
1 month ago
Chapter Completed
- Log analysis with queries
+1 XP
1 month ago
Chapter Completed
- Log sources and SIEM
+1 XP
1 month ago
Flag Found
- Template Injector
+50 XP
1 month ago
Flag Found
- LDAP Injector
+50 XP
1 month ago
Flag Found
- Redis Cache Poisoner
+50 XP
1 month ago
Flag Found
- MongoDB Injector
+50 XP
1 month ago
Flag Found
- SUID Privilege Hunter
+50 XP
1 month ago
Flag Found
- Registry Hijacker
+50 XP
1 month ago
Flag Found
- GraphQL Gateway
+50 XP
1 month ago
Flag Found
- Button Activator
+50 XP
1 month ago
Flag Found
- Cookie Forge
+50 XP
1 month ago
Flag Found
- File Include Bypass
+50 XP
1 month ago
Flag Found
- Corporate Directory Hunt
+50 XP
1 month ago
Flag Found
- Header Hijacker
+50 XP
1 month ago
Flag Found
- Caesar Shift Decoder
+50 XP
1 month ago
Flag Found
- DNS Tunneling Detective
+50 XP
1 month ago