Management Wants a Word — TryHackMe Hacker Holidays 2026 Day 14 Writeup
Day 14 forensics walkthrough: an autologon secret in the SECURITY hive unwinds DPAPI to Chrome's saved password, which opens a VeraCrypt vault. Flags redacted.
Paolo Costanzo — Independent Cybersecurity Research
Research reports, reproducible labs and technical field notes on cloud security, agentic AI and MCP, threat intelligence, networks and authorized offensive validation.
Latest posts
The Guestbook — TryHackMe Hacker Holidays 2026 Day 13 Writeup
Day 13 walkthrough: /vera/activity shows every tool call VERA makes. Indirect prompt injection reaches the override: tool, which runs /bin/sh. Flags redacted.
After Hours — TryHackMe Hacker Holidays 2026 Day 12 Writeup
Day 12 forensics walkthrough: no specialist parser — strings and python3 carve OBJECTS.DATA to a CommandLineEventConsumer and a .NET payload. Flags redacted.
CTF Writeups — Hacker Holidays 2026 (Byte Lotus Hotel)
Step-by-step writeups for the TryHackMe Hacker Holidays 2026 series: a room a day across OSINT, web, cloud, forensics and boot2root. Every writeup is a reproducible runbook with methodology, defensive notes and redacted flags — the method is the point, not the flag value.
Infinity Pool — TryHackMe Hacker Holidays 2026 Day 11 Writeup
Day 11 walkthrough: command injection on a Flask netcheck, hard-coded FreePBX 16 UCP creds (CVE-2026-46376), a key in a voicemail, then root. Flags redacted.
The Hollow Shell — TryHackMe Hacker Holidays 2026 Day 10 Writeup
Day 10 walkthrough: zip-slip beats an allowlist that only reads the manifest, then a poisoned Jinja template fires on a fresh gunicorn worker. Flags redacted.
CryptoCabana — TryHackMe Hacker Holidays 2026 Day 9 Writeup
Day 9 Azure walkthrough: an over-scoped SAS token lists the whole account, a hidden container leads to Key Vault, the flag in an old version. Flags redacted.
Towel on the Sunbed — TryHackMe Hacker Holidays 2026 Day 8 Writeup
Day 8 walkthrough: a TOCTOU race on /claim, ten Burp Repeater tabs in parallel, Whale tier. The detail most posts skip: the session must be clean. Flags redacted.
Do Not Disturb — TryHackMe Hacker Holidays 2026 Day 7 Writeup
Day 7 boot2root walkthrough: $ne login bypass, EJS SSTI on /staff/preview, RCE, then root without uid=0 via node --inspect and the disk group. Flags redacted.
Overheard at Breakfast — TryHackMe Hacker Holidays Day 6 Writeup
Day 6 OSINT walkthrough: a Discord screenshot leaks an email, the normalised MD5 opens the Gravatar, and /{md5}.json hides the flag in aboutMe. Flags redacted.
Beach Bar — TryHackMe Hacker Holidays 2026 Day 5 Writeup
Day 5 boot2root walkthrough: demo creds in view-source, an unsafe yaml.load turns a playlist import into RCE, ps aux leaks the root password. Flags redacted.
Packed Light — TryHackMe Hacker Holidays 2026 Day 4 Writeup
Day 4 forensics walkthrough: from pcap to a keylogger exfiltrating keystrokes in Cookie headers. One char at a time, so it stays single-byte XOR. Flags redacted.
Complimentary — TryHackMe Hacker Holidays 2026 Day 3 Writeup
Day 3 cloud walkthrough: the kiosk hands you AWS keys. An anonymous Cognito pool plus an IAM role that allows dynamodb:Scan dumps the table. Flags redacted.
MCP 2026-07-28: Stateless Does Not Mean State-Free
Revision 2026-07-28 removes MCP protocol sessions and, in the same document, forbids treating possession of a state handle as authentication. An executable conformance test for that MUST NOT: three key strategies compared under identical tokens and UUIDs, 13/13 tests, fully in-process lab. The composite key the specification recommends turns out to be bypassable when the principal id contains the…
Room 404 — TryHackMe Hacker Holidays 2026 Day 2 Writeup
Day 2 walkthrough: one curl to /.git/HEAD confirms the leak, git-dumper rebuilds the repo, and the flag sits in a supposedly cleaned commit. Flags redacted.
The Concierge Knows Too Much — TryHackMe Hacker Holidays Day 1 Writeup
Day 1 walkthrough: prompt injection on the VERA LLM concierge. No jailbreak — recognition isn't authentication, so she lists the VIPs herself. Flags redacted.
The Brochure — TryHackMe Hacker Holidays 2026 Day 0 Writeup
Day 0 walkthrough: the EXIF is clean, the clue is printed. From the PNG brochure to an Instagram account, its only following, three Base64 posts. Flags redacted.
Wearable Biometric Telemetry: Technical Tear-down and Data Supply Chain
Tear-down of a sensor ring (infrared PPG at 250 Hz, skin temperature at 0.1 °C), analysis of the v2 API and sync endpoints, documentary reconstruction of the corporate and investment chain, review of the clinical literature and of the US class actions. Includes a self-critique section and explicit limitations.
Coordinated Abuse Network on Telegram: Content Moderation, Payment Rails and Regulatory Response
Starting from a published CNN investigation, a threat intelligence analysis of how an abuse-material distribution network stayed operational across content moderation, crypto payment rails and regulatory oversight. Public journalistic and documentary sources. Sensitive content.
Anatomy of a TRON Wallet Drainer-as-a-Service
Analysis of an affiliate-model drainer infrastructure: from the initial phishing message to the TRC-20 approval chain, mapping of collection wallets and command infrastructure, $13,960 in transfers traced on-chain. Public sources, open channels and blockchain data.
SSRF → IMDSv1: Exfiltrating IAM Credentials from an EC2 Instance
Reproducible lab on an owned environment: from an application-level SSRF against 169.254.169.254 to the instance role's temporary credentials. Documented context (Capital One, 106 million records) and verifiable mitigations: HttpTokens=required, hop limit, least-privilege role policies.
Evil Portal, Beacon Spam and Deauth: a €40 Hardware Wi-Fi Lab
Classroom lab on an isolated lab network: Cardputer-Adv with Bruce firmware, evil portal, beacon spam and 802.11 deauthentication. Hardware setup, commands, observed results and client- and infrastructure-side countermeasures (802.11w/PMF, captive portal verification, DNS and certificates).
Operation Epic Fury: Independent OSINT Analysis of a Dual-Platform Campaign
OSINT investigation into an Android + Windows campaign attributed to an Iranian actor. A Windows payload not documented in public reporting, a secondary C2 at 0/94 VirusTotal detections at time of analysis, infrastructure registered roughly 8 months before the operation. Comparison with the Unit 42 and CloudSEK reports, IoCs and detection rules.
TIM, GeForce Now and the ICMP Black Hole
Diagnosing an ICMP black hole on an access network that broke Path MTU Discovery, causing packet loss on GeForce Now and capping throughput at 26 Mbps on a 1 Gbps line. Measurement method, isolation of the offending hop and MTU/MSS-side workaround.
AWS IAM: Five Recurring Misconfigurations and How to Fix Them
Wildcards in policies, root user without MFA, exposed static access keys, over-permissive roles and disabled logging. For each: how to detect it, why it matters and the applicable fix, mapped to Well-Architected Framework controls.
Prompt Injection on Enterprise LLMs: Attack Surface and Mitigations
An LLM wired into internal data and application tooling introduces an attack surface traditional threat models do not cover. Walk-through of the input → context → tool call chain and applicable mitigations: privilege separation, tool-level authorization, output validation and invocation logging.