## https://sploitus.com/exploit?id=150ACA67-DFF4-5327-B95C-88998EA7FDC9
# Cybersecurity CTF & Lab Writeups
A collection of hands-on cybersecurity challenges, CTF solutions, and technical investigations.
This repository documents challenges I have completed across different cybersecurity events and platforms. Each write-up focuses on the techniques used, the exploitation or investigation process, the underlying vulnerability or root cause, and the lessons learned.
## Events
### THM Defcon CTF Event
**Overflow The Jackpot CTF**
A TryHackMe Defcon CTF event consisting of five tasks covering different areas of practical cybersecurity.
The event writeups include:
- Technical investigation and exploitation steps
- Custom scripts developed during the challenges
- Screenshots documenting important findings
- Flags recovered during each task
[View the event writeups](./THM%20Defcon%20CTF%20Event/Overflow%20The%20Jackpot%20CTF/)
---
### Hacker Holidays 2026
**TryHackMe — Hacker Holidays 2026**
A 14-day cybersecurity challenge completed one room per day.
The event covered a broad range of cybersecurity topics, including:
- Web exploitation
- Cloud security
- Network forensics
- Windows forensics
- OSINT
- AI and prompt injection
- Malware analysis
- Authentication and authorization vulnerabilities
- Privilege escalation
- Race conditions
- Reverse shells
- Remote code execution
- Credential and secret recovery
Each day contains a dedicated write-up with supporting screenshots and, where applicable, scripts used during the investigation.
[View the Hacker Holidays 2026 writeups](./Hacker%20Holidays%202026/)
## Skills & Techniques
The challenges documented in this repository cover a wide range of practical cybersecurity techniques, including:
- Web application security
- Authentication bypass
- Broken access control
- SQL and NoSQL injection
- Server-Side Template Injection (SSTI)
- Remote Code Execution (RCE)
- Command injection
- Reverse shells
- Privilege escalation
- Race conditions
- API enumeration
- Cloud security
- AWS Cognito and IAM
- Azure Blob Storage and SAS tokens
- Azure Key Vault
- Network traffic analysis
- Covert channels
- XOR and Base64 analysis
- WMI forensics and persistence
- PowerShell analysis
- .NET malware analysis
- OSINT and public-source investigation
- Prompt injection
- LLM agent abuse
- Windows credential recovery
- DPAPI analysis
- Browser credential decryption
- Digital forensics
## Repository Structure
```text
Writeups/
│
├── README.md
│
├── THM Defcon CTF Event/
│ └── Overflow The Jackpot CTF/
│ ├── Introduction/
│ ├── Task1/
│ ├── Task2/
│ ├── Task3/
│ ├── Task4/
│ └── Task5/
│
└── Hacker Holidays 2026/
├── Day01_The Concierge Knows Too Much/
├── Day02_Room 404/
├── Day03_Complimentary/
├── Day04_Packed Light/
├── Day05_Beach Bar/
├── Day06_Overheard at Breakfast/
├── Day07_Do Not Disturb/
├── Day08_Towel on the Sunbed/
├── Day09_CryptoCabana/
├── Day10_The Hollow Shell/
├── Day11_Infinity Pool/
├── Day12_After Hours/
├── Day13_The Guestbook/
└── Day14_Management Wants a Word/
```
Individual challenge directories may contain:
```text
notes.md
screenshots/
scripts/
```
The `screenshots` directories contain selected evidence and important findings from the investigations, while the `scripts` directories contain custom scripts used to automate or assist with specific tasks.
## Portfolio
The writeups are also presented through my personal portfolio:
**https://yessine.is-a.dev/**
The portfolio provides a visual way to browse the completed challenges and their corresponding technical write-ups.
## Disclaimer
All techniques, commands, scripts, and exploitation methods documented in this repository were performed against intentionally vulnerable systems and controlled cybersecurity challenge environments.
This repository is intended for:
- Educational purposes
- Cybersecurity learning
- CTF practice
- Technical documentation
- Personal skill development
Do not use the techniques described here against systems or applications without explicit authorization.
## Author
**Yessine Helal**
Personal portfolio:
**https://yessine.is-a.dev/**