Offensive Security Knowledge Base

Capture the flag. Keep the methodology.

Detailed technical writeups that document the path from enumeration through compromise, including the mistakes, dead ends, tooling, and lessons that make the solution reusable.

Choose a collection

Field notes from systems designed to fight back.

Browse machine and challenge writeups by platform. Existing technical content is preserved while the surrounding experience is modernized.

Machines and Challenges

Hack The Box

Retired boxes and challenges documented from initial reconnaissance through user and root compromise, with the reasoning behind each move preserved.

Enumeration Exploitation Privilege Escalation Post-Exploitation

Browse Hack The Box writeups

Annual Security Challenges

SANS Holiday Hack

Multi-stage holiday challenges covering investigation, exploitation, forensics, scripting, cloud, and defensive-security problem solving.

Forensics Web Security Cloud Incident Response

Browse SANS challenges

Responsible publishing

The work is public. The target still matters.

Phoenix writeups are published for education and authorized practice. Hack The Box systems are not published here until they have retired, and nothing on this site should be interpreted as permission to test systems you do not own or explicitly have authorization to assess.

The point is to preserve useful methodology: how evidence was gathered, how assumptions were tested, where the path failed, and what ultimately produced a defensible result.