The Network Security capstone as a question sheet: a full-port sweep, flags tucked into service banners, an FTP brute-force, and a stealth scan, answered end to end.

MediaHub hides its logic in the traffic: a leaked backup gives the admin password format, a forged is_verified field skips the OTP, and a decimal-IP curl injection reads the flag off disk.

A forgotten staging box: anonymous FTP leaks the source, an allow-list that resolves to localhost turns the URL previewer into an SSRF, and a tar wildcard in a root backup cron finishes the job.

A robots.txt tip-off, a one-quote login bypass, and a newline in a ping box open the door; a leaked bcrypt hash and a sudo-able find close out the promotion.

A SQLi login bypass and a Node preview route that require()s uploads into RCE, then loot on disk and a leaky APK carry the foothold clean through a pivot to Domain Admin.

Every tile topples the next: a leaked key, a forged JWT, and a little RFI cascade all the way into root.

Proxy's mirror image: crack a KeePass vault, then write your own delegation right onto the DC and S4U to SYSTEM.

Every request goes through someone, be that someone, and constrained delegation hands you the DC.

A hidden portal, a newline that smuggles commands past the filter, and a KeePass vault guarding root.

Anonymous FTP to root through a daisy-chain of Linux privesc classics, finishing on sudo less.

A four-hop Windows climb: SMB to RDP to AutoLogon to a service hijack, and finally SYSTEM.

A password-cracking gauntlet: default creds, OSINT-built wordlists, and a hashed filename, all the way to SSH.

md5('true') is not authentication: path traversal, an IDOR, and a lazy filter give up a shell.

A friendly starter: a file:// wrapper leaks the creds and a UNION injection grabs the flag.