Practical Malware Analysis Lab 01-01 through 01-04

This post covers the initial static and dynamic analysis pass for the four samples in Practical Malware Analysis Lab 01: Lab01-01.dll, Lab01-01.exe, Lab01-02.exe, Lab01-03.exe, and Lab01-04.exe. Th...

Aug 16, 2026 analysis, security, malware, lab

LetsDefend - SOC104 - EventID 36

Overview SOC104 - EventID 36 is a practice challenge on the letsdefend.io site. These challenges are designed to test a defender’s ability to spot and investigate malicious activity based on the in...

Oct 4, 2025 analysis, security, malware

Markup

Overview Markup is a vulnerable machine from Hack the Box that requires some web app enumeration and using an xxe injection to read files. The foothold is accomplished after gaining access to a log...

Mar 10, 2024 ctf, security, hacking, exploits, scheduled job abuse, ssh, weak credentials, arbitrary file upload, xxe injection

Base

Overview Base is a vulnerable machine from Hack the Box that requires some web app enumeration and a unique type juggling with php. The foothold is accomplished after digging into a unique file and...

Mar 9, 2024 ctf, security, hacking, exploits, sudo exploitation, arbitrary file upload, authentication bypass, php type juggling

Querier

Overview Querier is a vulnerable machine from Hack the Box that requires some smb enumeration and using SQL server authentication. The foothold is accomplished after logging into SQL Server, dumpin...

Mar 6, 2024 ctf, security, hacking, exploits, sql server, information disclosure, weak credentials, anonymous access

Bastard

Overview Bastard is a vulnerable machine from Hack the Box that requires some web app enumeration and using a public exploit for remote code execution on a vulnerable service. The foothold is accom...

Mar 6, 2024 ctf, security, hacking, exploits, web application, os command injections

Bastion

Overview Bastion is a vulnerable machine from Hack the Box that requires some deeper smb enumeration, with exploring some unique files, and mounting the smb share locally to take a closer look. The...

Mar 3, 2024 ctf, security, hacking, exploits, weak authentication, anonymous access

Arctic

Overview Arctic is a vulnerable machine from Hack the Box that requires some basic web enumeration with using exploits to grab credentials and get a shell. The foothold is accomplished after using ...

Mar 3, 2024 ctf, security, hacking, exploits, web application, directory listing, arbitrary file upload, misconfiguration

SecNotes

Overview SecNotes is a vulnerable machine from Hack the Box that requires some basic web enumeration and file reading, with using SQL Injection on the login page. The foothold is accomplished after...

Feb 27, 2024 ctf, security, hacking, exploits, web application, sql injection, arbitrary file upload, arbitrary file write, cross site request forgery

Alfred

Overview Alfred is a vulnerable machine from TryHackMe that requires some standard enumeration with abusing token impersonation. The foothold is accomplished after some enumeration of the web page ...

Feb 24, 2024 ctf, security, hacking, exploits, web application