# Notes

## Notes

- [About me.](https://heapbytes.gitbook.io/notes/about-me..md): https://github.com/heapbytes/
- [2022 CTFs](https://heapbytes.gitbook.io/notes/ctf-writeups/2022-ctfs.md)
- [HTB Santa CTF 2022](https://heapbytes.gitbook.io/notes/ctf-writeups/2022-ctfs/htb-santa-ctf-2022.md)
- [Technovanza 2022](https://heapbytes.gitbook.io/notes/ctf-writeups/2022-ctfs/technovanza-2022.md)
- [2023 CTFs](https://heapbytes.gitbook.io/notes/ctf-writeups/2023-ctfs.md): Few soln for challenges that I though to share.
- [Blackhat MEA CTF](https://heapbytes.gitbook.io/notes/ctf-writeups/2023-ctfs/blackhat-mea-ctf.md): https://ctftime.org/ctf/826/
- [Web - Authy](https://heapbytes.gitbook.io/notes/ctf-writeups/2023-ctfs/blackhat-mea-ctf/web-authy.md)
- [YCTF (week 2 - 9 Dec 23)](https://heapbytes.gitbook.io/notes/ctf-writeups/2023-ctfs/yctf-week-2-9-dec-23.md): A win!!
- [Web Security](https://heapbytes.gitbook.io/notes/ctf-writeups/2023-ctfs/yctf-week-2-9-dec-23/web-security.md)
- [IE10.1](https://heapbytes.gitbook.io/notes/ctf-writeups/2023-ctfs/yctf-week-2-9-dec-23/web-security/ie10.1.md): http://yctfinternet.liveblog365.com/
- [Confluence](https://heapbytes.gitbook.io/notes/ctf-writeups/2023-ctfs/yctf-week-2-9-dec-23/web-security/confluence.md): http://139.59.45.27:8090/admin/flag.tar.gz
- [Cookie](https://heapbytes.gitbook.io/notes/ctf-writeups/2023-ctfs/yctf-week-2-9-dec-23/web-security/cookie.md): Challenge link: https://cookiechallenge.pythonanywhere.com/
- [Misc - Never found](https://heapbytes.gitbook.io/notes/ctf-writeups/2023-ctfs/yctf-week-2-9-dec-23/misc-never-found.md)
- [VM - boot2root](https://heapbytes.gitbook.io/notes/ctf-writeups/2023-ctfs/yctf-week-2-9-dec-23/vm-boot2root.md): https://tryhackme.com/room/yctfweek2Mv
- [Reversing - Easy](https://heapbytes.gitbook.io/notes/ctf-writeups/2023-ctfs/yctf-week-2-9-dec-23/reversing-easy.md)
- [2024 CTFs](https://heapbytes.gitbook.io/notes/ctf-writeups/2024-ctfs.md)
- [Down Under CTF](https://heapbytes.gitbook.io/notes/ctf-writeups/2024-ctfs/down-under-ctf.md)
- [Beginner](https://heapbytes.gitbook.io/notes/ctf-writeups/2024-ctfs/down-under-ctf/beginner.md)
- [tldr please summarise](https://heapbytes.gitbook.io/notes/ctf-writeups/2024-ctfs/down-under-ctf/beginner/tldr-please-summarise.md)
- [parrot the emu](https://heapbytes.gitbook.io/notes/ctf-writeups/2024-ctfs/down-under-ctf/beginner/parrot-the-emu.md)
- [Sun Zi's Perfect Math Class](https://heapbytes.gitbook.io/notes/ctf-writeups/2024-ctfs/down-under-ctf/beginner/sun-zis-perfect-math-class.md)
- [zoo feedback form](https://heapbytes.gitbook.io/notes/ctf-writeups/2024-ctfs/down-under-ctf/beginner/zoo-feedback-form.md)
- [shufflebox](https://heapbytes.gitbook.io/notes/ctf-writeups/2024-ctfs/down-under-ctf/beginner/shufflebox.md)
- [HackTheBoo](https://heapbytes.gitbook.io/notes/ctf-writeups/2024-ctfs/hacktheboo.md)
- [Practice](https://heapbytes.gitbook.io/notes/ctf-writeups/2024-ctfs/hacktheboo/practice.md)
- [Web - Void Whispers](https://heapbytes.gitbook.io/notes/ctf-writeups/2024-ctfs/hacktheboo/practice/web-void-whispers.md)
- [Web - Unholy Union](https://heapbytes.gitbook.io/notes/ctf-writeups/2024-ctfs/hacktheboo/practice/web-unholy-union.md)
- [Web - Phantom's Script](https://heapbytes.gitbook.io/notes/ctf-writeups/2024-ctfs/hacktheboo/practice/web-phantoms-script.md)
- [2025 CTFs](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs.md)
- [Pico CTF](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/pico-ctf.md)
- [3v@l](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/pico-ctf/3v-l.md)
- [WebSockFish](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/pico-ctf/websockfish.md)
- [Payatu CTF](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/payatu-ctf.md)
- [Infrastructure](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/payatu-ctf/infrastructure.md)
- [Web](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/payatu-ctf/web.md)
- [Secure Upload](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/payatu-ctf/web/secure-upload.md): File upload bypass - Magic bytes
- [Travel Agency](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/payatu-ctf/web/travel-agency.md): LFI + RFI
- [Blind Trust](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/payatu-ctf/web/blind-trust.md): NOSQLi
- [HackTheBox](https://heapbytes.gitbook.io/notes/rooms/hackthebox.md): HTB machines that I pwned ^^
- [Web challenges](https://heapbytes.gitbook.io/notes/rooms/hackthebox/web-challenges.md): Few web challs
- [Renderquest](https://heapbytes.gitbook.io/notes/rooms/hackthebox/web-challenges/renderquest.md): https://app.hackthebox.com/challenges/renderquest
- [CurlAsAService](https://heapbytes.gitbook.io/notes/rooms/hackthebox/web-challenges/curlasaservice.md)
- [Easy](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy.md): Htb machines - level: Easy
- [Code](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/code.md): https://app.hackthebox.com/machines/Code
- [PermX](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/permx.md): https://app.hackthebox.com/machines/PermX
- [Chemistry](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/chemistry.md)
- [Cicada](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/cicada.md)
- [Boardlight](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/boardlight.md)
- [Sightless](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/sightless.md)
- [Headless](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/headless.md): https://app.hackthebox.com/machines/Headless/
- [Bizness](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/bizness.md)
- [Devvortex](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/devvortex.md): https://app.hackthebox.com/machines/Devvortex
- [Sau](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/sau.md): Easy machine.
- [Broker](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/broker.md): https://app.hackthebox.com/machines/Broker
- [Topology](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/topology.md): https://app.hackthebox.com/machines/Topology
- [Horizontall](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/horizontall.md)
- [Backdoor](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/backdoor.md): By htb.
- [Soccer](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/soccer.md)
- [Secret](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/secret.md)
- [Shoppy](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/shoppy.md)
- [Cap](https://heapbytes.gitbook.io/notes/rooms/hackthebox/easy/cap.md)
- [Medium](https://heapbytes.gitbook.io/notes/rooms/hackthebox/medium.md): Medium Machines by HTB.
- [Heal](https://heapbytes.gitbook.io/notes/rooms/hackthebox/medium/heal.md)
- [MonitorsThree](https://heapbytes.gitbook.io/notes/rooms/hackthebox/medium/monitorsthree.md)
- [Trickster](https://heapbytes.gitbook.io/notes/rooms/hackthebox/medium/trickster.md)
- [Instant](https://heapbytes.gitbook.io/notes/rooms/hackthebox/medium/instant.md)
- [IClean](https://heapbytes.gitbook.io/notes/rooms/hackthebox/medium/iclean.md)
- [Builder](https://heapbytes.gitbook.io/notes/rooms/hackthebox/medium/builder.md): https://app.hackthebox.com/machines/Builder
- [Sandworm](https://heapbytes.gitbook.io/notes/rooms/hackthebox/medium/sandworm.md): https://app.hackthebox.com/machines/Sandworm
- [Shibboleth](https://heapbytes.gitbook.io/notes/rooms/hackthebox/medium/shibboleth.md)
- [Format - incomplete](https://heapbytes.gitbook.io/notes/rooms/hackthebox/medium/format-incomplete.md): Level - Medium
- [Hard](https://heapbytes.gitbook.io/notes/rooms/hackthebox/hard.md)
- [Caption](https://heapbytes.gitbook.io/notes/rooms/hackthebox/hard/caption.md)
- [Insane](https://heapbytes.gitbook.io/notes/rooms/hackthebox/insane.md)
- [Skyfall](https://heapbytes.gitbook.io/notes/rooms/hackthebox/insane/skyfall.md)
- [Tryhackme](https://heapbytes.gitbook.io/notes/rooms/tryhackme.md): Tryhackme rooms.
- [WhyHackMe](https://heapbytes.gitbook.io/notes/rooms/tryhackme/whyhackme.md)
- [Bad Byte](https://heapbytes.gitbook.io/notes/rooms/tryhackme/bad-byte.md)
- [Wonderland](https://heapbytes.gitbook.io/notes/rooms/tryhackme/wonderland.md)
- [Overpass](https://heapbytes.gitbook.io/notes/rooms/tryhackme/overpass.md)
- [Athena](https://heapbytes.gitbook.io/notes/rooms/tryhackme/athena.md): Writeup.
- [Archangel](https://heapbytes.gitbook.io/notes/rooms/tryhackme/archangel.md): Writeup.
- [Hacker Vs Hacker](https://heapbytes.gitbook.io/notes/rooms/tryhackme/hacker-vs-hacker.md)
- [ADB Cheatsheet](https://heapbytes.gitbook.io/notes/apk-pentesting/adb-cheatsheet.md)
- [Tools & Get Started](https://heapbytes.gitbook.io/notes/apk-pentesting/tools-and-get-started.md)
- [Pull & Patch](https://heapbytes.gitbook.io/notes/apk-pentesting/pull-and-patch.md)
- [Static analysis](https://heapbytes.gitbook.io/notes/apk-pentesting/static-analysis.md)
- [Hardcoded strings](https://heapbytes.gitbook.io/notes/apk-pentesting/static-analysis/hardcoded-strings.md)
- [Find creds/db/api key](https://heapbytes.gitbook.io/notes/apk-pentesting/static-analysis/find-creds-db-api-key.md)
- [Cloud - aws, azure, google](https://heapbytes.gitbook.io/notes/apk-pentesting/static-analysis/cloud-aws-azure-google.md)
- [Deobfuscation](https://heapbytes.gitbook.io/notes/apk-pentesting/static-analysis/deobfuscation.md)
- [Dynamic Analysis](https://heapbytes.gitbook.io/notes/apk-pentesting/dynamic-analysis.md)
- [Frida](https://heapbytes.gitbook.io/notes/apk-pentesting/dynamic-analysis/frida.md)
- [MITM proxy](https://heapbytes.gitbook.io/notes/apk-pentesting/dynamic-analysis/mitm-proxy.md)
- [File Upload Bypass](https://heapbytes.gitbook.io/notes/web-security/file-upload-bypass.md)
- [To remember LoG](https://heapbytes.gitbook.io/notes/web-security/to-remember-log.md): Writing few intresting things I liked. Maybe too basic sometimes :)
- [SSTI](https://heapbytes.gitbook.io/notes/web-security/ssti.md)
- [Eval bypass](https://heapbytes.gitbook.io/notes/web-security/eval-bypass.md)
- [HTTP Headers](https://heapbytes.gitbook.io/notes/web-security/http-headers.md)
- [Content Security Policy](https://heapbytes.gitbook.io/notes/web-security/http-headers/content-security-policy.md): HTTP header - CSP
- [Bypass Techniques](https://heapbytes.gitbook.io/notes/web-security/http-headers/content-security-policy/bypass-techniques.md)
- [what is? General info](https://heapbytes.gitbook.io/notes/active-directory/what-is-general-info.md): will organise as time passes.......
- [LLMNR poisoning](https://heapbytes.gitbook.io/notes/active-directory/llmnr-poisoning.md)
- [Attack list for pentest](https://heapbytes.gitbook.io/notes/active-directory/attack-list-for-pentest.md)
- [Overview (fundamentals/cheatsheet)](https://heapbytes.gitbook.io/notes/overview-fundamentals-cheatsheet.md): cheatsheet
- [Windows](https://heapbytes.gitbook.io/notes/overview-fundamentals-cheatsheet/windows.md): fundamentals
- [EJPT v2](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2.md): These are just my notes i took during EJPT v2.  (more like  a cheatsheet)
- [Assesment Methodology](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/assesment-methodology.md)
- [Passive info gathering](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/assesment-methodology/passive-info-gathering.md)
- [Enumeration techniques](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/assesment-methodology/enumeration-techniques.md): some enum techniques cheatssheet
- [Samba (SMB)](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/assesment-methodology/enumeration-techniques/samba-smb.md)
- [FTP](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/assesment-methodology/enumeration-techniques/ftp.md): File Transfer protocol (port 21)
- [SSH](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/assesment-methodology/enumeration-techniques/ssh.md): Secure Shell protocol (port 22)
- [HTTP](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/assesment-methodology/enumeration-techniques/http.md): Hypertext transfer protocol (port 80)
- [Mysql and Mssql](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/assesment-methodology/enumeration-techniques/mysql-and-mssql.md): mysql (port 3306) ....... mssql(port 1443)
- [Host & Network Pentest](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/host-and-network-pentest.md)
- [Linux](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/host-and-network-pentest/linux.md)
- [Checklist (priv esc)](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/host-and-network-pentest/linux/checklist-priv-esc.md)
- [Windows](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/host-and-network-pentest/windows.md)
- [Checklist (Priv Esc)](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/host-and-network-pentest/windows/checklist-priv-esc.md): some priv esc techniques
- [Web app pentest](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/web-app-pentest.md): cheatsheet for those tools m not familiar with (sorry m not covering all tools, most of em are easy)
- [Host & Network pentest (MSF)](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/host-and-network-pentest-msf.md)
- [Post exploitation](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/post-exploitation.md)
- [Windows](https://heapbytes.gitbook.io/notes/certifications/ejpt-v2/post-exploitation/windows.md): priv esc