Hands-on penetration testing, vulnerability analysis, and CTF writeups from authorized training environments.
This repository documents my practical learning journey across web application security, reconnaissance, exploitation, vulnerability analysis, steganography, and offensive security techniques.
Each writeup walks through the methodology end to end: enumeration, identifying the weakness, exploitation, and key takeaways.
Warning
Disclaimer: All testing documented here was performed against intentionally vulnerable systems in authorized training and CTF environments. The techniques and commands are provided for educational purposes only.
RedTeam-Lab-Writeups/
│
├── Web/
│ ├── Broken Access Control.md
│ ├── Broken Authentication_web.md
│ ├── Command Injection.md
│ ├── Ignore The Door.md
│ ├── Insecure Deserialization.md
│ ├── Monkey.md
│ ├── Sensitivity/
│ ├── Serial-Killer/
│ ├── SocketStorm.md
│ ├── Source/
│ ├── SSTI_web.md
│ └── XXE.md
│
├── Steganography/
│ └── Hidden/
│
├── Misc/
│ └── UnRavel/
│
└── README.md
Writeups covering common web vulnerabilities and offensive techniques:
- Broken Access Control
- Broken Authentication
- Command Injection
- Insecure Deserialization
- Server-Side Template Injection (SSTI)
- XML External Entity (XXE)
- Source Code Analysis
- Authentication & Authorization Testing
- Web Enumeration & Reconnaissance
- Exploitation of intentionally vulnerable applications
Challenges involving hidden information, file analysis, metadata inspection, and steganographic techniques.
Challenges involving encoding, obfuscation, file analysis, and other techniques that don't fit the primary categories.
| Category | Tools |
|---|---|
| Operating System | Kali Linux |
| Web Testing | Burp Suite, curl, SQLmap, Gobuster |
| Recon & Scanning | Nmap, Gobuster |
| Credential Attacks | Hydra |
| Forensics & Stego | Steghide, Binwalk, ExifTool |
| Scripting | Python, Linux command-line utilities |
| # | Challenge | Focus | Writeup |
|---|---|---|---|
| 1 | Broken Access Control | Access Control | 📝 Read |
| 2 | Broken Authentication | Authentication | 📝 Read |
| 3 | Command Injection | Command Injection | 📝 Read |
| 4 | Ignore The Door | Web Security | 📝 Read |
| 5 | Insecure Deserialization | Deserialization | 📝 Read |
| 6 | Monkey | Web Security | 📝 Read |
| 7 | Sensitivity | Web Security | 📝 Read |
| 8 | Serial Killer | Web Security | 📝 Read |
| 9 | SocketStorm | Web Security | 📝 Read |
| 10 | Source | Source Code Analysis | 📝 Read |
| 11 | SSTI | Server-Side Template Injection | 📝 Read |
| 12 | XXE | XML External Entity | 📝 Read |
| # | Challenge | Focus | Writeup |
|---|---|---|---|
| 1 | Hidden | Steganography / File Analysis | 📝 Read |
| # | Challenge | Focus | Writeup |
|---|---|---|---|
| 1 | UnRavel | Encoding / Analysis | 📝 Read |
- Document hands-on cybersecurity labs
- Practice penetration testing methodologies
- Understand real-world vulnerability classes in controlled environments
- Improve technical documentation and reporting skills
- Track my progress in offensive security
- Build a practical cybersecurity portfolio
This repository is continuously updated as I complete new labs, challenges, and security exercises. Watch or star the repo to follow along.
All techniques demonstrated in this repository are intended for authorized security testing, cybersecurity education, CTFs, and controlled laboratory environments.
Caution
Do not use these techniques against systems without explicit written authorization.
More writeups coming soon. 🚀