Liam Smydo

Complete API pentesting notes + working through PortSwigger labs

A hard TryHackMe box that chains WordPress brute-forcing, PHP webshell injection, credential harvesting from a plaintext file, and a Ligolo-ng pivot to an internal Jenkins instance — ultimately escalating to root via a plaintext password left in a Docker container.

A hard TryHackMe Active Directory box that chains anonymous SMB/LDAP enumeration, OSINT credential recovery from a public Git repository, Kerberoasting, and PrintNightmare (CVE-2021-1675) local privilege escalation to fully compromise the domain.

A hard TryHackMe box exploiting a known Joomla 3.7 SQL injection vulnerability to extract and crack admin credentials, followed by a PHP webshell for initial access and a yum sudo misconfiguration for privilege escalation to root.

Comprehensive web application penetration test of the Hack Smarter e-commerce platform. 30 vulnerabilities identified — SQL injection, RCE, XSS, SSRF, CSRF, IDOR, and session management weaknesses — with a full attack chain from unauthenticated visitor to remote code execution.

A medium TryHackMe box chaining mass assignment, SSRF, and Jinja2 SSTI to gain initial access, then escalating to root by leveraging an exposed Erlang cookie to extract credentials from a misconfigured RabbitMQ service.