Cloud intrusions have quietly become an identity-and-API problem more than a malware problem. CrowdStrike's 2025 Global Threat Report put valid-account abuse as the top initial-access method in cloud incidents, and access-broker advertising for stolen credentials keeps climbing year over year. The attacker doesn&…
The blogpost below is LLM generated summary of the notes and screenshots of my environment taken while working on the CyberDefenders SignalHunt 2026 CTF, which my team consisting of my collegues @0xEnleak and Pedro landed at 4th place. As the challenges are down, I don't have notes for…
You've gained access to a container running some infrastructure automation. A cron job executes Terraform every minute to keep certificates fresh. The flag is stored in a privileged user's home directory - but you're just a regular user with no direct access. Can you find…
You've gained access to a pod in the staging environment. To beat this challenge, you'll have to spread throughout the cluster and escalate privileges. Can you reach the flag? Good luck! Kubernetes environment, goal is to get details in the kube-system. We can start by…
We have got intelligence that one our developers at Ack-Me Corp is working on a weekend side-project where he is vibe coding an internal knowledge-base chatbot for our company, where he put all of our customer records and sensitive data inside it. Your mission, if you choose…
I participated in HackTheBox's first defensive-focused CTF event this week with my team Kapital, ending with a 4th place finish (and only seconds away from that 3rd place podium finish). In this CTF the main challenge I worked on was The Enduring Echo, a DFIR challenge where…
As an APT group targeting Azure, you've discovered a web app that creates admin users, but they are heavily restricted. To gain initial access, you've created a malicious OAuth app in your tenant and now seek to deploy it into the victim's tenant. Can…
This is my writeup for July's challenge of Wiz's Cloud Security Championship. They plan to release a CTF challenge for each month of the year, each created by one of their own researchers. You can find my previous solves below: Perimeter Leak - Wiz Cloud CTF JuneThis…
