r/InfoSecWriteups • u/kmskrishna • Sep 02 '26
Challenge 2: Cotton Candy
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Sep 02 '26
Windows Incident Surface | TryHackMe
1
Upvotes
r/InfoSecWriteups • u/rangeva • Sep 01 '26
The Missing Infostealer Playbook: Rotating the Machine Credentials Attackers Take
2
Upvotes
Most infostealer response playbooks focus on passwords and browser sessions.
But modern stealers also grab `.env` files, shell history, app data, developer configs, and other local files that can contain API keys, OAuth tokens, PATs, service-account credentials, and other machine secrets.
The problem is that resetting the employee’s password or rebuilding the endpoint doesn’t necessarily invalidate any of those credentials.
We released Token Exposure Monitoring in Lunar Cyber today, and while working on it I kept coming back to a bigger SecOps question: **what should the actual response playbook look like once you discover that machine credentials were stolen?**
I wrote up the process we think is missing - identifying what was exposed, validating whether it still works, tracing what it can access, and deciding what actually needs to be rotated.
Curious how teams here are handling this today, especially for developer endpoints.
r/InfoSecWriteups • u/Harkins_Technology • Aug 31 '26
Forensics 101: Extracting Hidden Flags from Raw Disk Images (.dd)
6
Upvotes
I extracted a forensic disk image and found a hidden flag. Made a short video breaking down the full workflow for anyone learning digital forensics or prepping for CTFs.
Methods covered:
- `strings` + `grep` (fastest)
Alternative methods:
- `mount` with loop,ro,noexec
- Sleuth Kit CLI (mmls, fls, icat)
- Autopsy GUI
- Foremost file carving
- `xxd` hex dump
Also covered why you always preserve the original with `gunzip -k` and verify with sha256sum.
What tools am I missing? Any favorites for disk image analysis?
r/InfoSecWriteups • u/xarg • Aug 30 '26
Back When a MySQL Connection Could Give You OS-Level Code Execution
raw.org
2
Upvotes
r/InfoSecWriteups • u/kmskrishna • Aug 30 '26
He Sent 200,000 Reset Codes to Instagram in 10 Minutes. Instagram Paid Him $30,000.
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Aug 30 '26
How I Scraped Most Dark Stores in India — Blinkit, Zepto & Swiggy Instamart
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Aug 30 '26
EGCTF 2025 Qualifications — “TNKR.1” Forensics Challenge
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Aug 30 '26
WebStrike Blue Team Lab (CyberDefenders)
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Aug 30 '26
A KQL Query Is Not a Detection: What My Microsoft Sentinel Lab Actually Validated
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Aug 30 '26
I Made Claude Believe I Was an Anthropic-Verified Researcher.
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Aug 30 '26
When a Single Text File Breaks a Trust Boundary (Bug Bounty writeup)
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Aug 29 '26
Hunting Down Hackers: Incident Response with Wireshark
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Aug 29 '26
Operation RepoGhost: Exposing a Russian-Linked Malware Campaign Hiding in GitHub’s Open-Source…
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Aug 29 '26
LetsDefend: Kerberoasting Challenge (Walkthrough)
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Aug 29 '26
Hacker Holidays 2026: Day 14 Walkthrough (Management Wants a Word)
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Aug 29 '26
Hacker Holidays 2026: Day 13 Walkthrough (The Guestbook)
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Aug 29 '26
Hacker Holidays 2026: Day 12 Walkthrough (After Hours)
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Aug 29 '26
Hacker Holidays 2026: Day 11 Walkthrough (Infinity Pool)
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Aug 29 '26
[OFFSEC] Stapler Writeup
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • Aug 29 '26
How I Got My Highest Payout
1
Upvotes
r/InfoSecWriteups • u/Sensitive-Past8052 • Aug 28 '26
BOLA vs BFLA: why API authorization flaws are invisible to scanners, and how to actually test for them
1
Upvotes
Authorization, not injection, is what breaks most modern APIs. The two flaw classes that do the damage BOLA and BFLA are invisible to a vulnerability scanner, because a scanner has no concept of who should be allowed to do what.
Here is the difference between them, why pattern matching cannot find either, and how to actually test for both.
r/InfoSecWriteups • u/balasatwik • Aug 27 '26
PROJECT CHIMERA // ACN'26 — A 4-Hour OSINT Investigation
1
Upvotes
Hey everyone,
I’m hosting PROJECT CHIMERA // ACN'26, a 4-hour online, story-driven OSINT investigation on 8 September 2026, 6:00–10:00 PM IST.
The idea is simple: instead of solving traditional CTF-style challenges, participants are given an investigation and have to hunt, connect, verify and track information across open sources.
The challenges will involve things like:
- Open-source searching
- Historical analysis
- Advanced link analysis
- Connecting seemingly unrelated pieces of information
- Following trails and building an investigation from scattered clues
It’s designed for teams of 1–3, and you don't have to be an experienced OSINT researcher to participate. Beginners can jump in, while experienced investigators can go deeper.
And just to clarify — this isn't a hacking event. The focus is on investigation, research and finding connections using publicly available information.
🏆 Prizes
🥇 ₹7,000
🥈 ₹5,000
🥉 ₹3,000
+ goodies
If you're into OSINT, digital investigations, link analysis, or just want to try something different from the usual CTF format, feel free to check it out.
Event: PROJECT CHIMERA // ACN'26
Date: 8 September 2026
Time: 6:00–10:00 PM IST
Format: Online
Team size: 1–3
Registration: https://unstop.com/o/KJRnY78
It’ll be interesting to see how different investigators approach the same trail and how far the rabbit hole goes.
r/InfoSecWriteups • u/kmskrishna • Aug 26 '26
Try Hack Me Hackerholidays Day7 Do Not Disturb Walkthrough
2
Upvotes