Recent content on Nathan Ellison
There are only a few things in this world that drive me to the brink of madness while keeping me engaged at the same time. CTFs are one of them. The 30th of July marked the end of the annual Hack The Box Cyber Apocalypse CTF, one of my favourite CTFs of the year. What sets this CTF apart from all of the other competitions that Hack The Box run is the sheer number of challenges. There’s…
In May of 2026, I completed the Dante Pro Lab on Hack The Box. Having played plenty of Hack The Box machines already, taking on an entire network was a welcome change of pace. What is Dante? Dante is one of the many Pro Lab environments offered by Hack The Box. Rather than being tasked with attacking just a single machine, Pro Labs require players to infiltrate a simulated corporate network and…
Imagery is a medium difficulty Linux machine on Hack The Box. It hosts a web application that allows users to upload image files and make alterations to them (cropping, rotating etc). The application contains a bug report form which is vulnerable to cross site scripting, which can be exploited to hijack the session of the admin user. The admin user can access a log file download function which is…
Obsidian is the best note-taking and knowledge management software out there (in my opinion). I use it for loads of things, from CTFs to software development, and canvases are one of my favourite Obsidian features. While I was playing the Dante Pro Lab from Hack The Box, I needed a way to keep track of where I was within the network. It’s easy to get lost and forget which machines…
Of all the great file formats in the world, the best ones are only readable by a single program that only comes with one particular operating system. The ubiquity of Excel becomes a problem when you’re using Kali Linux. You might come across a spreadsheet on a host or fileshare but not be able to read it because you haven’t got Libre Office or Excel installed! What to do? Markitdown…
In February of 2026, I received the Certified Web Exploitation Specialist certification from Hack The Box. It wasn’t long after recovering from the CPTS cert that I began to feel the itch to go after another one. I was impressed by the quality and pricing of my previous learning experience on Hack The Box Academy, so I continued my journey with them. At the time of writing, Hack The Box…
By default Burp Suite will not intercept traffic to localhost or 127.0.0.1 . Here are two solutions to fix that: 1. Configure Firefox Options Go to the about:config URL and set network.proxy.allow_hijacking_localhost to true . 2. Add Fake Domain to /etc/hosts Add an entry to the /etc/hosts file to point to 127.0.0.1 . 127.0.0.1 localhost 255.255.255.255 broadcasthost ::1 localhost lokalhost…
I ran into an interesting issue with one of my virtual machines recently. I was playing a Hack The Box challenge and wanted to spin up a local version of the vulnerable app inside my virtual machine using Docker. I ran the script that retrieved the required packages and… used all of the available disk space in my VM. “Not to worry, I’ll just shut it down, increase the disk size…
Every website and service seems to require you to make an account these days. It’s hardly surprising that people use the same password for many services when every one of those services require you to make a new account. One Christmas, I was pulled into a game of Secret Santa. There was just one problem with my group: nobody was in the same city - we were all spread across the country.
Permx is an easy difficulty machine from Hack The Box. It features a website for an online learning platform which is run using the Chamilo e-learning software. Chamilo contains an unrestricted file upload vulnerability that allows the upload of a webshell that can be used to gain a reverse shell as www-data . Analysing the source code of the Chamilo installation reveals the database password that…
Spooky season has come and gone once again and hackers the world over got in on the fun with the Hack The Boo CTF from Hack The Box. It was a three day long event that ran from the 24th to the 27th of October (UTC). There were the usual challenge categories to play: web, crypto, pwn, reversing, forensics, and coding. Sadly there were no spooky AIs to talk to this year. Maybe next year…
Essential recipes for every ServiceNow developer chef. (Last updated November 2025) Consult this blog post for scripts that you can use to automate common ServiceNow admin and developer tasks. Records Quick scripts for managing records. Duplicate Record Make a copy (or copies) of a record. function dupeRecord () { // script parameters var table_name = 'TABLE_NAME_HERE' ; var target_record_id =…
As the time on my computer ticked over to 5 a.m., I found myself staring at my monitor with wide, bloodshot eyes. Terminals, code editors, browser tabs, and the Down Under CTF flag submission page filled my field of view. We had started strong, and the team had steadily been climbing the leaderboard during the day. By 5 a.m., progress had slowed as the caffeine wore off. Sleep was imminent. I…
All of my spare time in 2024 and the first third of 2025 was dedicated to studying the CPTS certification from Hack The Box. I’m absolutely ecstatic to report that I successfully passed the exam and am now a Certified Penetration Testing Specialist! The journey to obtaining this cert has been super challenging, but I’m so glad that I did it. It taught me so much about computers,…
I participated in this year’s Hack The Box Global Cyber Skills Benchmark. It’s their yearly CTF aimed at corporate security teams (previously dubbed the Business CTF ). This year’s theme was about a rogue government APT (Advanced Persistent Threat) named The Empire of Volnaya . They had launched covert operations that aimed to disrupt the critical infrastructure of its rivals,…
Heal is a medium difficulty box on Hack The Box. It contains a resume generator website that generates PDF documents using information that is provided by the user. The site also contains a survey section where users can submit feedback for the application. After identifying the application hosting the survey, identifying the admin user, and finding their password, it is possible to log in as them…
Analytics is an easy difficulty Linux machine available on Hack The Box. The box was running a version of the Metabase business intelligence software that contained a pre-auth remote code execution vulnerability. After exploiting the vulnerability, a shell inside a docker container was gained. Enumerating the environment variables of the container revealed a password that was used to gain a…
Chemistry is an easy difficulty Linux machine on Hack The Box. It contains a website that allows users to upload CIF (Crystallographic Information File) files, which are text files that describe the structure and properties of crystals. The python library that the box uses to parse these files use eval to process the data, making it vulnerable to code injection. After exploiting this vulnerability…
Trial By Fire was an easy difficulty web challenge for the Hack The Box Cyber Apocalypse 2025 CTF. It was a dragon fighting game that was implemented using Python Flask. This particular application was vulnerable to Server Side Template Injection (SSTI), which could be exploited to read the flag off of the server. The Gameplay Before I look at the source code of a challenge, I like to spin up the…
In late March of this year, the Cyber Apocalypse 2025 Capture The Flag competition was held. It was a 5 day event that spanned the globe, with a total of 8,130 teams signing up to play. The theme for this year was that of a Dungeons n Dragons style MMO which had been taken over by some malevolent force that was keeping it’s players held hostage inside the game. The Premise Earlier this…
I thoroughly believe that anyone with any kind of passion for anything should have a website. A website is your own platform for sharing your experiences, your struggles, your creations, and your work with anyone and everyone. There are a million different ways to create one. You could build one yourself from scratch, or just pay some third-party service to create and host one for you. Whether…
If you’re constantly needing to create markdown tables and/or parse them for use with python , then you might find this useful. While working on a project involving generating PDFs, I wrote a couple of useful scripts that I wanted to share. I was needing to create markdown tables of varying sizes, but I ran into the inevitable issue of the syntax being awkward and time consuming to type.…
GreenHorn is an easy difficulty machine from Hack The Box. It contains a website that was created using a version of the Pluck content management system that is vulnerable to an authenticated arbitrary file upload. There is also a Gitea instance running on the box that leaks the Pluck admin password hash. After cracking the hash and logging into Pluck , the arbitrary file upload vulnerability is…
Secret is an easy difficulty Linux machine from Hack The Box. It involves using a leaked secret to forge a JSON web token. The token is then used to exploit a command injection vulnerability present in a vulnerable API endpoint. The root flag is obtained by reading the contents of file descriptors present in the core dump of an SUID binary. Enumeration Let the recon begin. Nmap Every box begins…
Last month was the 2024 Hack The Boo CTF from Hack The Box. It happens each Halloween, and comes with many sp00ky hacking challenges 🎃. My calendar was rather full on the weekend during which the CTF took place, so I was only able to complete a small amount of the challenges that were available. Nevertheless, it was still a great experience. Hack The Box always provide amazing quality challenges,…
Disclaimer: I do not encourage nor condone using maliciously crafted barcodes or QR codes against systems that you do not own! Don’t hack things you don’t own! I was talking to a friend the other day and they told me something that I think is going to stick with me for a long time: You are a massive nerd. — Trusted friend
Blurry is a medium difficulty machine on Hack The Box. It features a server that hosts an instance of ClearML ; a platform for building, training, and deploying AI models. The particular version of the platform running on the box contains a remote code execution vulnerability that can be abused to gain a foothold on the box. The user account on the box is able to run a PyTorch model validation…
Challenge Description Cryptosystems like RSA works on numbers, but messages are made up of characters. How should we convert our messages into numbers so that mathematical operations can be applied? The most common way is to take the ordinal bytes of the message, convert them into hexadecimal, and concatenate. This can be interpreted as a base-16/hexadecimal number, and also represented in…
Challenge Description Another common encoding scheme is Base64, which allows us to represent binary data as an ASCII string using an alphabet of 64 characters. One character of a Base64 string encodes 6 binary digits (bits), and so 4 characters of Base64 encode three 8-bit bytes. Base64 is most commonly used online, so binary data such as images can be easily included into HTML or CSS files. Take…
Challenge Description When we encrypt something the resulting ciphertext commonly has bytes which are not printable ASCII characters. If we want to share our encrypted data, it’s common to encode it into something more user-friendly and portable across different systems. Hexadecimal can be used in such a way to represent ASCII strings. First each letter is converted to an ordinal number…
Challenge Decription ASCII is a 7-bit encoding standard which allows the representation of text using the integers 0-127. Using the below integer array, convert the numbers to their corresponding ASCII characters to obtain a flag. [99, 114, 121, 112, 116, 111, 123, 65, 83, 67, 73, 73, 95, 112, 114, 49, 110, 116, 52, 98, 108, 51, 125] Solution Using the python chr() function allows the conversion…
Challenge Description Each challenge is designed to help introduce you to a new piece of cryptography. Solving a challenge will require you to find a “flag”. These flags will usually be in the format crypto{y0ur_f1rst_fl4g} . The flag format helps you verify that you found the correct solution. Try submitting this flag into the form below to solve your first challenge. Solution This…
Summary Noxious is a very easy difficulty sherlock challenge from Hack The Box. The challenge provides a single capture.pcap file for analysis. Scenario The IDS device alerted us to a possible rogue device in the internal Active Directory network. The Intrusion Detection System also indicated signs of LLMNR traffic, which is unusual. It is suspected that an LLMNR poisoning attack occurred. The…
Summary Meerkat is an easy difficulty sherlock challenge from Hack The Box. This was the first sherlock that I ever solved on the platform. The challenge provides a .zip file that contains only two files; meerkat-alerts.json , and meerkat.pcap . Scenario As a fast-growing startup, Forela has been utilising a business management platform. Unfortunately, our documentation is scarce, and our…
After I earned my computer science degree a few years ago, I found myself feeling a little burnt out. I had spent four years sitting through relentless lectures and exams and had come out the other side with my fancy piece of paper. After all of that, I felt that my interest in programming had faded. I still loved technology, but I didn’t feel the urge to sit down and code. I felt…
Codify is an easy difficulty Linux box available on Hack The Box. The box hosts a JavaScript sandbox that can easily be broken out of to execute commands on the server and gain a foothold as a low privileged user. A hashed password is then extracted from a SQLite database of support tickets. After cracking the password, access to the second user account on the box is gained. Privilege escalation…
Crafty is an easy difficulty Windows machine on Hack The Box. It involves exploiting a vulnerable Minecraft server with the Log4j zero-day from 2021. After gaining a foothold on the box, a password is discovered inside a custom plugin that is used on the server, which can be used to elevate privileges to the Administrator user. Enumeration Enumeration began with an nmap scan. Nmap sudo nmap -sCV…
EXciting Outpost Recon was one of the “Very Easy” difficulty cryptography challenges for the Hack The Box Business CTF 2024. It uses XOR encryption to encrypt the flag, while simultaneously giving away the beginning of the message, leading to the recovery of the entire message. Challenge Description Hijacking the outpost responsible for housing the messengers of the core gangs, we have…
In May of this year, my work colleagues and I participated in the Hack The Box Business CTF 2024 . It was a hacking competition that took place worldwide from May 18th to May 22nd , and it attracted over 900 teams from various businesses located all over the world. This was the first ever CTF ( capture the flag ) competition that I had participated in. It was a ton of fun to take part in, and…
Quick, there’s a new custom Pokemon in the bush called “The Custom Pokemon”. Can you find out what its weakness is and capture it? Gonna-Lift-Em-All is a very easy difficulty challenge from Hack The Box. To solve it, we need solve some modular arithmetic equations to recover the flag. Files Provided chall.py - the script used to encrypt the flag out.txt - the output of chall.py…
You are walking with your friends in search of sweets and discover a mansion in the distance. All your friends are too scared to approach the building, so you go on alone. As you walk down the street, you see expensive cars and math papers all over the yard. Finally, you reach the door. The doorbell says “Michael Fastcar”. You recognise the name immediately because it was on the news…
Sau is an easy difficulty machine from Hack The Box. While playing this machine, we encounter concepts including server side request forgery (SSRF), vulnerable software, pagers, and a recent CVE (at the time of writing). Enumeration We begin with some reconnaissance. Nmap Our first step is to scan the box with nmap to find out which ports are open. nmap -sC -sV TARGET-IP After letting nmap run for…
Busqueda is an easy difficulty machine available from Hack The Box. While playing the machine, we encounter concepts including docker containers, Unix paths, dangerous python functions, and git. Enumeration Let’s begin gathering information about the machine. Nmap We start off with an nmap scan. nmap -sC -sV TARGET-IP After nmap runs for a bit, we get the following output: Nmap scan report…
Inject is an easy difficulty machine from Hack The Box. While playing this machine, we encounter concepts including arbitrary file reading, the Spring framework, and Ansible. Enumeration Let’s begin with some reconnaissance. Nmap We begin by scanning the box with nmap . nmap -sC -sV TARGET-IP > scan.txt After we let nmap run for a bit, we see the following results: Nmap scan report for…