Coming Soon
Writeups cover retired Hack The Box machines, challenges, and Sherlocks only, in line with HTB's rules on publishing solutions. Each one walks through enumeration, the path in, privilege escalation, and the lesson worth keeping.
WELCOME TO SHABBADOO'S SECURITY LAB
CYBERSECURITY LEARNING JOURNEY
A working notebook: writeups for retired Hack The Box machines, challenges, and Sherlocks, plus notes on the concepts I'm studying. What I'm learning, how I approached it, and what I got wrong along the way.
WRITEUPS
CURRENT FOCUS
Active Directory
Working through AD enumeration and attack paths: Kerberos abuse, ACL chains, credential relaying, and lateral movement, practiced in lab environments.
Web Application Security
OWASP Top 10 classes in practice: injection, broken access control, authentication flaws, and API testing, one lab at a time.
Cloud Security
IAM misconfiguration, metadata services, and cloud-native attack paths across AWS, Azure, and GCP, studied through intentionally vulnerable labs.
DevSecOps
Security in CI/CD pipelines: secret scanning, dependency and container scanning, and infrastructure-as-code checks.
Detection and Forensics
The other side of every attack: what each technique leaves behind in logs, memory, and network traffic, and how a defender would catch it.
AI in Security
How AI changes both sides: prompt injection and agent risks, and using models to speed up triage and analysis without trusting them blindly.