// project: ctf & labs

CTF Lab & Writeups

Hands-on capture-the-flag practice across HackTheBox and TryHackMe, building real offensive and defensive skills through structured challenges. Every technique, tool, and lesson learned gets documented in the SecOps-Vault.

Platforms

🟩

HackTheBox

Industry-standard penetration testing labs. Retired machines, active challenges, and Pro Labs covering real-world attack scenarios and CVEs.

🟥

TryHackMe

Guided learning paths and structured rooms covering fundamentals through advanced topics. Ideal for building foundational skills before moving to HTB.

CTF Categories

🌐

Web

SQL injection, XSS, SSRF, authentication bypass, directory traversal, and API security. OWASP Top 10 as the core framework.

Burp Suitecurl OWASP ZAPNikto

🔬

Forensics

Memory analysis, disk imaging, log analysis, network packet inspection, and file carving. Recovering artifacts from compromised systems.

VolatilityWireshark Autopsybinwalk

🔑

Cryptography

Cipher analysis, hash cracking, encoding schemes, RSA weaknesses, and weak key identification. Breaking encryption without the key.

HashcatJohn CyberChefPython

🕵️

OSINT

Open-source intelligence gathering: usernames, email addresses, geolocation, metadata extraction, and social media footprinting.

MaltegotheHarvester ShodanExifTool

⚙️

Reverse Engineering

Binary analysis, disassembly, decompilation, and understanding compiled code without source. Identifying malware behavior and hidden logic.

Ghidrastrings ltracestrace

💥

Pwn / Exploitation

Binary exploitation, buffer overflows, format string vulnerabilities, and return-oriented programming (ROP). Low-level vulnerability exploitation.

pwntoolsGDB pedachecksec

Writeup Methodology

Recon: enumerate the target. Nmap service scans, directory busting, banner grabbing. Map the full attack surface before touching anything.

Identify: find the vulnerability. Match service versions to CVEs, probe endpoints, analyze source or binary. Document every finding.

Exploit: gain initial access. Use the identified vector cleanly. Note the exact payload, tool, and command used, reproducibility matters.

Escalate: move from foothold to full control. SUID binaries, weak sudo rules, credential reuse, misconfigured services.

Document: write the full writeup into the SecOps-Vault. Command-by-command. What worked, what didn't, and why. Lessons carry forward.

SecOps-Vault Integration

📚 Everything gets documented

All CTF writeups, tool notes, and methodology guides live in the SecOps-Vault, a personal Obsidian knowledge base with 168 notes across 13 sections. The vault has dedicated sections for Labs (HTB + THM write-ups), CTF methodology, and tool documentation. Nothing gets lost, every machine becomes a reference for the next one.

HackTheBoxTryHackMe Web SecurityForensics CryptographyOSINT Reverse EngineeringExploitation WriteupsSecOps-Vault