Paolo Costanzo — Independent Cybersecurity Research

Day 14 forensics walkthrough: an autologon secret in the SECURITY hive unwinds DPAPI to Chrome's saved password, which opens a VeraCrypt vault.

Day 13 walkthrough: /vera/activity shows every tool call VERA makes.

Day 12 forensics walkthrough: no specialist parser — strings and python3 carve OBJECTS.DATA to a CommandLineEventConsumer and a .NET payload.

Day 11 walkthrough: command injection on a Flask netcheck, hard-coded FreePBX 16 UCP creds (CVE-2026-46376), a key in a voicemail, then root.

Step-by-step writeups for the TryHackMe Hacker Holidays 2026 series: a room a day across OSINT, web, cloud, forensics and boot2root.

Day 10 walkthrough: zip-slip beats an allowlist that only reads the manifest, then a poisoned Jinja template fires on a fresh gunicorn worker.

Day 9 Azure walkthrough: an over-scoped SAS token lists the whole account, a hidden container leads to Key Vault, the flag in an old version.

Day 8 walkthrough: a TOCTOU race on /claim, ten Burp Repeater tabs in parallel, Whale tier.

Day 7 boot2root walkthrough: $ne login bypass, EJS SSTI on /staff/preview, RCE, then root without uid=0 via node --inspect and the disk group.

Day 6 OSINT walkthrough: a Discord screenshot leaks an email, the normalised MD5 opens the Gravatar, and /{md5}.json hides the flag in aboutMe.

Day 5 boot2root walkthrough: demo creds in view-source, an unsafe yaml.load turns a playlist import into RCE, ps aux leaks the root password.

Day 4 forensics walkthrough: from pcap to a keylogger exfiltrating keystrokes in Cookie headers.

Revision 2026-07-28 removes MCP protocol sessions and, in the same document, forbids treating possession of a state handle as authentication.

Day 3 cloud walkthrough: the kiosk hands you AWS keys.

Day 2 walkthrough: one curl to /.git/HEAD confirms the leak, git-dumper rebuilds the repo, and the flag sits in a supposedly cleaned commit.

Day 1 walkthrough: prompt injection on the VERA LLM concierge.

Day 0 walkthrough: the EXIF is clean, the clue is printed.

Tear-down of a sensor ring (infrared PPG at 250 Hz, skin temperature at 0.1 °C), analysis of the v2 API and sync endpoints, documentary reconstruction of the corporate and investment chain, review of the clinical literature and of the US class actions.

Starting from a published CNN investigation, a threat intelligence analysis of how an abuse-material distribution network stayed operational across content moderation, crypto payment rails and regulatory oversight.

Analysis of an affiliate-model drainer infrastructure: from the initial phishing message to the TRC-20 approval chain, mapping of collection wallets and command infrastructure, $13,960 in transfers traced on-chain.

Reproducible lab on an owned environment: from an application-level SSRF against 169.254.169.254 to the instance role's temporary credentials.

Classroom lab on an isolated lab network: Cardputer-Adv with Bruce firmware, evil portal, beacon spam and 802.11 deauthentication.

OSINT investigation into an Android + Windows campaign attributed to an Iranian actor.

Diagnosing an ICMP black hole on an access network that broke Path MTU Discovery, causing packet loss on GeForce Now and capping throughput at 26 Mbps on a 1 Gbps line.

An LLM wired into internal data and application tooling introduces an attack surface traditional threat models do not cover.

Wildcards in policies, root user without MFA, exposed static access keys, over-permissive roles and disabled logging.