HackTheBox Writeups

"Wrong gobuster wordlist wasted 30mins — and missing a semicolon in the payload caused a 500 for longer than I'd like to admit"

"Webshell broke because of bash variable interpolation — double quotes stripped $_REQUEST. Single quotes fixed it instantly"

"Shell looked completely blank after the exploit fired — it was actually live, just needed a command typed to confirm"

"Tier 0 exists to teach one concept per box — if you're stuck, the answer is almost always the simplest thing you haven't tried yet"