Principiante WEB - EWPT Roadmap
Este roadmap está inspirado al 100% en el HackingVault de s4vitar. Aunque está etiquetado para eWPT, su extensión y profundidad cubren todo el espectro del pentesting web, desde vulnerabilidades básicas (OWASP Top 10) hasta técnicas avanzadas de exploitation web, sirviendo también para certificaciones superiores como eWPTX o CBBH.
Objetivo: Maestría total en ataques web (SQLi, XSS, SSRF, Deserialization, JWT, HTTP Smuggling).
Recurso: La propiedad intelectual y todas las resoluciones en video pertenecen al canal público de S4viSinFiltro.
🟢 FASE 1: FUNDAMENTOS & OWASP TOP 10
SEMANA 1: Metodología y Herramientas
Enfoque: OWASP Top 10 y Burp Suite basics.
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Admirer | Hack The Box | Easy | Ver 🎥 | Adminer / FTP | |
| Alert | Hack The Box | Easy | Ver 🎥 | XSS / PHP | |
| Analytics | Hack The Box | Easy | Ver 🎥 | Metabase Pre-Auth | |
| Arctic | Hack The Box | Easy | Ver 🎥 | ColdFusion | |
| Backdoor | Hack The Box | Easy | Ver 🎥 | Wordpress / LFI |
SEMANA 2: SQL Injection Avanzado
Enfoque: Blind, Time-based y Out-of-band SQLi.
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Bank | Hack The Box | Easy | Ver 🎥 | Upload / HTB Classic | |
| Beep | Hack The Box | Easy | Ver 🎥 | Elastix / LFI | |
| Bizness | Hack The Box | Easy | Ver 🎥 | Apache OFBiz | |
| Blunder | Hack The Box | Easy | Ver 🎥 | CMS Blunder | |
| BoardLight | Hack The Box | Easy | Ver 🎥 | Dolibarr CRM |
SEMANA 3: Cross-Site Scripting (XSS)
Enfoque: Bypass de filtros, DOM XSS y Stored XSS.
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Bounty | Hack The Box | Easy | Ver 🎥 | IIS / ASP | |
| BountyHunter | Hack The Box | Easy | Ver 🎥 | XXE / Log Analysis | |
| Broker | Hack The Box | Easy | Ver 🎥 | ActiveMQ / Nginx | |
| Chemistry | Hack The Box | Easy | Ver 🎥 | CIF files / Python | |
| Code | Hack The Box | Easy | Ver 🎥 | VM Sandbox |
SEMANA 4: Autenticación y Sesiones
Enfoque: Session fixation, Broken Auth.
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Codify | Hack The Box | Easy | Ver 🎥 | NodeJS Sandbox | |
| CozyHosting | Hack The Box | Easy | Ver 🎥 | Spring Boot | |
| Curling | Hack The Box | Easy | Ver 🎥 | Joomla / Snap | |
| Delivery | Hack The Box | Easy | Ver 🎥 | Ticket System | |
| Devvortex | Hack The Box | Easy | Ver 🎥 | Joomla |
SEMANA 5: IDOR & Logic Flaws (Parte 1)
Enfoque: Mass assignment, Parameter tampering.
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Doctor | Hack The Box | Easy | Ver 🎥 | SSTI | |
| Dog | Hack The Box | Easy | Ver 🎥 | ||
| Editorial | Hack The Box | Easy | Ver 🎥 | SSRF / Git | |
| Frolic | Hack The Box | Easy | Ver 🎥 | Node loop overflow | |
| GoodGames | Hack The Box | Easy | Ver 🎥 | SQLi |
SEMANA 6: IDOR & Logic Flaws (Parte 2)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Grandpa | Hack The Box | Easy | Ver 🎥 | IIS 6.0 | |
| Granny | Hack The Box | Easy | Ver 🎥 | IIS 6.0 | |
| GreenHorn | Hack The Box | Easy | Ver 🎥 | Pluck CMS | |
| Haystack | Hack The Box | Easy | Ver 🎥 | ElasticSearch | |
| Headless | Hack The Box | Easy | Ver 🎥 | XSS / Cookies |
SEMANA 7: IDOR & Logic Flaws (Parte 3)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Horizontall | Hack The Box | Easy | Ver 🎥 | Strapi CMS | |
| Inject | Hack The Box | Easy | Ver 🎥 | Spring Cloud | |
| Laboratory | Hack The Box | Easy | Ver 🎥 | GitLab | |
| Late | Hack The Box | Easy | Ver 🎥 | OCR / SSTI | |
| LinkVortex | Hack The Box | Easy | Ver 🎥 | Ghostscript |
SEMANA 8: IDOR & Logic Flaws (Parte 4)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Love | Hack The Box | Easy | Ver 🎥 | Voting System | |
| Luanne | Hack The Box | Easy | Ver 🎥 | Lua Injection | |
| Mailing | Hack The Box | Easy | Ver 🎥 | SMTP | |
| MetaTwo | Hack The Box | Easy | Ver 🎥 | Wordpress booking | |
| MonitorsTwo | Hack The Box | Easy | Ver 🎥 | Cacti |
SEMANA 9: IDOR & Logic Flaws (Parte 5)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Netmon | Hack The Box | Easy | Ver 🎥 | PRTG | |
| Networked | Hack The Box | Easy | Ver 🎥 | Apache / PHP | |
| Nocturnal | Hack The Box | Easy | Ver 🎥 | ||
| NodeBlog | Hack The Box | Easy | Ver 🎥 | NoSQL / Node | |
| NunChucks | Hack The Box | Easy | Ver 🎥 | SSTI |
SEMANA 10: IDOR & Logic Flaws (Parte 6)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| OpenSource | Hack The Box | Easy | Ver 🎥 | Gitea | |
| Optimum | Hack The Box | Easy | Ver 🎥 | HFS | |
| PC | Hack The Box | Easy | Ver 🎥 | SQLMap API | |
| Pandora | Hack The Box | Easy | Ver 🎥 | SNMP / Pandora | |
| Paper | Hack The Box | Easy | Ver 🎥 | Wordpress |
SEMANA 11: IDOR & Logic Flaws (Parte 7)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Perfection | Hack The Box | Easy | Ver 🎥 | SSTI Ruby | |
| PermX | Hack The Box | Easy | Ver 🎥 | Chamilo LMS | |
| Photobomb | Hack The Box | Easy | Ver 🎥 | Command Injection | |
| Pilgrimage | Hack The Box | Easy | Ver 🎥 | ImageMagick | |
| Postman | Hack The Box | Easy | Ver 🎥 | Redis / Webmin |
SEMANA 12: IDOR & Logic Flaws (Parte 8)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Precious | Hack The Box | Easy | Ver 🎥 | PDFKit | |
| Previse | Hack The Box | Easy | Ver 🎥 | PHP Exec | |
| RedPanda | Hack The Box | Easy | Ver 🎥 | SSTI Java | |
| Remote | Hack The Box | Easy | Ver 🎥 | Umbraco | |
| RouterSpace | Hack The Box | Easy | Ver 🎥 | Android / ADB |
SEMANA 13: IDOR & Logic Flaws (Parte 9)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Sau | Hack The Box | Easy | Ver 🎥 | SSRF / Maltrail | |
| Sea | Hack The Box | Easy | Ver 🎥 | WonderCMS | |
| Secret | Hack The Box | Easy | Ver 🎥 | JWT / API | |
| Sense | Hack The Box | Easy | Ver 🎥 | Pfsense | |
| Servmon | Hack The Box | Easy | Ver 🎥 | NVMS |
SEMANA 14: IDOR & Logic Flaws (Parte 10)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Shocker | Hack The Box | Easy | Ver 🎥 | Shellshock | |
| Shoppy | Hack The Box | Easy | Ver 🎥 | NoSQL | |
| Sightless | Hack The Box | Easy | Ver 🎥 | SQLi | |
| Soccer | Hack The Box | Easy | Ver 🎥 | Websockets SQLi | |
| Spectra | Hack The Box | Easy | Ver 🎥 | Wordpress |
SEMANA 15: IDOR & Logic Flaws (Parte 11)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Stocker | Hack The Box | Easy | Ver 🎥 | NoSQL / SSRF | |
| SwagShop | Hack The Box | Easy | Ver 🎥 | Magento | |
| Tabby | Hack The Box | Easy | Ver 🎥 | Tomcat / LFI | |
| Teacher | Hack The Box | Easy | Ver 🎥 | Moodle | |
| Toolbox | Hack The Box | Easy | Ver 🎥 | Docker |
SEMANA 16: IDOR & Logic Flaws (Parte 12)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Topology | Hack The Box | Easy | Ver 🎥 | LaTeX Injection | |
| Traverxec | Hack The Box | Easy | Ver 🎥 | Nostromo | |
| Trick | Hack The Box | Easy | Ver 🎥 | SQLi / DNS | |
| TwoMillion | Hack The Box | Easy | Ver 🎥 | API Logic | |
| Usage | Hack The Box | Easy | Ver 🎥 | SQLi / Cookie |
SEMANA 17: IDOR & Logic Flaws (Final)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Valentine | Hack The Box | Easy | Ver 🎥 | Heartbleed | |
| Validation | Hack The Box | Easy | Ver 🎥 | SQLi |
🟠 FASE 2: NIVEL INTERMEDIO (WEB & API)
SEMANA 18: SSTI (Template Injection)
Enfoque: Jinja2, Twig y Sandbox escape.
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Ambassador | Hack The Box | Medium | Ver 🎥 | Grafana | |
| Apocalyst | Hack The Box | Medium | Ver 🎥 | CMS | |
| Aragog | Hack The Box | Medium | Ver 🎥 | XXE | |
| Awkward | Hack The Box | Medium | Ver 🎥 | JWT / API | |
| Backend | Hack The Box | Medium | Ver 🎥 | API |
SEMANA 19: Deserialización Web
Enfoque: PHP Object Injection y Java.
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| BackendTwo | Hack The Box | Medium | Ver 🎥 | API | |
| Bart | Hack The Box | Medium | Ver 🎥 | PHP / Internal | |
| Bastard | Hack The Box | Medium | Ver 🎥 | Drupal | |
| Blurry | Hack The Box | Medium | Ver 🎥 | ClearML (Pickle) | |
| Bolt | Hack The Box | Medium | Ver 🎥 | CMS Bolt |
SEMANA 20: SSRF (Server-Side Request Forgery)
Enfoque: Cloud metadata y redes internas.
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Book | Hack The Box | Medium | Ver 🎥 | XSS / Truncation | |
| BroScience | Hack The Box | Medium | Ver 🎥 | Deserialization | |
| Builder | Hack The Box | Medium | Ver 🎥 | Jenkins | |
| Cache | Hack The Box | Medium | Ver 🎥 | HMS / Docker | |
| Cat | Hack The Box | Medium | Ver 🎥 | Android API |
SEMANA 21: WebSockets & Real-Time
Enfoque: Socket.io y vectores en tiempo real.
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Catch | Hack The Box | Medium | Ver 🎥 | APK | |
| Celestial | Hack The Box | Medium | Ver 🎥 | Node Deserialization | |
| Chaos | Hack The Box | Medium | Ver 🎥 | PDF Gen | |
| Clicker | Hack The Box | Medium | Ver 🎥 | NFS / WebLogic | |
| Cronos | Hack The Box | Medium | Ver 🎥 | DNS / SQLi |
SEMANA 22: JWT Attacks (Parte 1)
Enfoque: Token forgery y Algorithm Confusion.
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| DevOops | Hack The Box | Medium | Ver 🎥 | XML / Git | |
| Devzat | Hack The Box | Medium | Ver 🎥 | InfluxDB | |
| Encoding | Hack The Box | Medium | Ver 🎥 | PHP Filters | |
| Enterprise | Hack The Box | Medium | Ver 🎥 | Pivoting | |
| Epsilon | Hack The Box | Medium | Ver 🎥 |
SEMANA 23: JWT Attacks (Parte 2)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Europa | Hack The Box | Medium | Ver 🎥 | Regex | |
| Faculty | Hack The Box | Medium | Ver 🎥 | mPDF | |
| Flustered | Hack The Box | Medium | Ver 🎥 | Squid | |
| FluxCapacitor | Hack The Box | Medium | Ver 🎥 | WAF Bypass | |
| Forge | Hack The Box | Medium | Ver 🎥 | SSRF |
SEMANA 24: JWT Attacks (Parte 3)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Format | Hack The Box | Medium | Ver 🎥 | Microblog | |
| Giddy | Hack The Box | Medium | Ver 🎥 | SQLi / Unquoted | |
| Haircut | Hack The Box | Medium | Ver 🎥 | Command Injection | |
| Hawk | Hack The Box | Medium | Ver 🎥 | Drupal | |
| Health | Hack The Box | Medium | Ver 🎥 | Webhook |
SEMANA 25: JWT Attacks (Parte 4)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| IClean | Hack The Box | Medium | Ver 🎥 | XSS / SSTI | |
| Inception | Hack The Box | Medium | Ver 🎥 | WebDav | |
| Interface | Hack The Box | Medium | Ver 🎥 | DOMpdf | |
| Jeeves | Hack The Box | Medium | Ver 🎥 | Jenkins | |
| Jewel | Hack The Box | Medium | Ver 🎥 | Rails Serialization |
SEMANA 26: JWT Attacks (Parte 5)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Json | Hack The Box | Medium | Ver 🎥 | Deserialization | |
| Jupiter | Hack The Box | Medium | Ver 🎥 | Grafana | |
| Lazy | Hack The Box | Medium | Ver 🎥 | Oracle Padding | |
| Luke | Hack The Box | Medium | Ver 🎥 | API | |
| Mango | Hack The Box | Medium | Ver 🎥 | NoSQLi |
SEMANA 27: JWT Attacks (Parte 6)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Mentor | Hack The Box | Medium | Ver 🎥 | API | |
| Meta | Hack The Box | Medium | Ver 🎥 | ImageMagick | |
| Monitored | Hack The Box | Medium | Ver 🎥 | Nagios | |
| MonitorsThree | Hack The Box | Medium | Ver 🎥 | SQLi / Cacti | |
| Nineveh | Hack The Box | Medium | Ver 🎥 | Hyde / LFI |
SEMANA 28: JWT Attacks (Parte 7)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Noter | Hack The Box | Medium | Ver 🎥 | Flask / JWT | |
| Obscurity | Hack The Box | Medium | Ver 🎥 | Custom Server | |
| Olympus | Hack The Box | Medium | Ver 🎥 | Xdebug / Docker | |
| OnlyForYou | Hack The Box | Medium | Ver 🎥 | LFI / Neo4j | |
| Passage | Hack The Box | Medium | Ver 🎥 | CuteNews |
SEMANA 29: JWT Attacks (Parte 8)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Pit | Hack The Box | Medium | Ver 🎥 | SNMP / SeedDMS | |
| Poison | Hack The Box | Medium | Ver 🎥 | LFI / VNC | |
| Popcorn | Hack The Box | Medium | Ver 🎥 | File Upload | |
| Pov | Hack The Box | Medium | Ver 🎥 | ||
| Ransom | Hack The Box | Medium | Ver 🎥 |
SEMANA 30: JWT Attacks (Parte 9)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| RedCross | Hack The Box | Medium | Ver 🎥 | XSS / Haraka | |
| Runner | Hack The Box | Medium | Ver 🎥 | TeamCity | |
| Schooled | Hack The Box | Medium | Ver 🎥 | Moodle | |
| Seal | Hack The Box | Medium | Ver 🎥 | Tomcat / GitBucket | |
| SecNotes | Hack The Box | Medium | Ver 🎥 | CSRF |
SEMANA 31: JWT Attacks (Parte 10)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Shared | Hack The Box | Medium | Ver 🎥 | Prestashop | |
| Shibboleth | Hack The Box | Medium | Ver 🎥 | Zabbix / IPMI | |
| Sniper | Hack The Box | Medium | Ver 🎥 | CHM | |
| Stratosphere | Hack The Box | Medium | Ver 🎥 | Struts | |
| StreamIO | Hack The Box | Medium | Ver 🎥 | Firefox / Forensics |
SEMANA 32: JWT Attacks (Parte 11)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Strutted | Hack The Box | Medium | Ver 🎥 | Struts | |
| Surveillance | Hack The Box | Medium | Ver 🎥 | ZoneMinder | |
| TartarSauce | Hack The Box | Medium | Ver 🎥 | Wordpress | |
| Tenet | Hack The Box | Medium | Ver 🎥 | PHP Object Injection | |
| Tenten | Hack The Box | Medium | Ver 🎥 | Wordpress |
SEMANA 33: JWT Attacks (Parte 12)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| TheNotebook | Hack The Box | Medium | Ver 🎥 | JWT / Docker | |
| Time | Hack The Box | Medium | Ver 🎥 | Java Deserialization | |
| Timing | Hack The Box | Medium | Ver 🎥 | PHP | |
| Trickster | Hack The Box | Medium | Ver 🎥 | PrestaShop | |
| Undetected | Hack The Box | Medium | Ver 🎥 | Modsecurity |
SEMANA 34: JWT Attacks (Parte 13)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Unicode | Hack The Box | Medium | Ver 🎥 | JWT Unicode | |
| Union | Hack The Box | Medium | Ver 🎥 | SQLi Union | |
| UpDown | Hack The Box | Medium | Ver 🎥 | File Upload | |
| Waldo | Hack The Box | Medium | Ver 🎥 | Path Traversal | |
| Wall | Hack The Box | Medium | Ver 🎥 | API / Python |
SEMANA 35: JWT Attacks (Final)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Worker | Hack The Box | Medium | Ver 🎥 | SVN / Azure | |
| Writer | Hack The Box | Medium | Ver 🎥 | SQLi / ImageMagic | |
| Zipping | Hack The Box | Medium | Ver 🎥 | Zip Slip |
🔴 FASE 3: NIVEL AVANZADO & EXPERTO
SEMANA 36: XXE Avanzado
Enfoque: Out-of-band XXE y filtrado.
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| AdmirerToo | Hack The Box | Hard | Ver 🎥 | OpenCATS | |
| Altered | Hack The Box | Hard | Ver 🎥 | PHP / CodeIgniter | |
| Analysis | Hack The Box | Hard | Ver 🎥 | LDAP | |
| Breadcrumbs | Hack The Box | Hard | Ver 🎥 | Windows |
SEMANA 37: Logic Flaws & Race Conditions
Enfoque: Errores de lógica de negocio y condiciones de carrera.
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Carpediem | Hack The Box | Hard | Ver 🎥 | Docker | |
| Charon | Hack The Box | Hard | Ver 🎥 | SQLi Union | |
| Conceal | Hack The Box | Hard | Ver 🎥 | IPSec / SNMP | |
| Control | Hack The Box | Hard | Ver 🎥 | MySQL |
SEMANA 38: GraphQL Avanzado
Enfoque: Introspection y Batching attacks.
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| CrimeStoppers | Hack The Box | Hard | Ver 🎥 | PHP / Zip | |
| Dab | Hack The Box | Hard | Ver 🎥 | Windows | |
| Drive | Hack The Box | Hard | Ver 🎥 | SQLite / API | |
| EarlyAccess | Hack The Box | Hard | Ver 🎥 | PHP / Keygen |
SEMANA 39: HTTP Smuggling & Poisoning (Parte 1)
Enfoque: Request Splitting y Cache Poisoning.
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Falafel | Hack The Box | Hard | Ver 🎥 | PHP / SQLi | |
| Feline | Hack The Box | Hard | Ver 🎥 | Tomcat / Java | |
| Flujab | Hack The Box | Hard | Ver 🎥 | ||
| Freelancer | Hack The Box | Hard | Ver 🎥 | SQLi / MSSQL |
SEMANA 40: HTTP Smuggling & Poisoning (Parte 2)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Hancliffe | Hack The Box | Hard | Ver 🎥 | Unity / SSRF | |
| Helpline | Hack The Box | Hard | Ver 🎥 | ||
| Holiday | Hack The Box | Hard | Ver 🎥 | Node / SQLi | |
| Joker | Hack The Box | Hard | Ver 🎥 | Squid |
SEMANA 41: HTTP Smuggling & Poisoning (Parte 3)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Kotarak | Hack The Box | Hard | Ver 🎥 | Tomcat | |
| Moderators | Hack The Box | Hard | Ver 🎥 | Wordpress / Logs | |
| Monitors | Hack The Box | Hard | Ver 🎥 | Wordpress | |
| Oouch | Hack The Box | Hard | Ver 🎥 | DBus / OAuth |
SEMANA 42: HTTP Smuggling & Poisoning (Parte 4)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Overflow | Hack The Box | Hard | Ver 🎥 | Padding Oracle | |
| Overgraph | Hack The Box | Hard | Ver 🎥 | ||
| Oz | Hack The Box | Hard | Ver 🎥 | Docker / PortKnocking | |
| Phoenix | Hack The Box | Hard | Ver 🎥 | Wordpress |
SEMANA 43: HTTP Smuggling & Poisoning (Parte 5)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Player | Hack The Box | Hard | Ver 🎥 | GraphQL / FFMPEG | |
| Pressed | Hack The Box | Hard | Ver 🎥 | Wordpress | |
| Quick | Hack The Box | Hard | Ver 🎥 | HTTP/2 / ESI Injection | |
| Scavenger | Hack The Box | Hard | Ver 🎥 |
SEMANA 44: HTTP Smuggling & Poisoning (Parte 6)
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Static | Hack The Box | Hard | Ver 🎥 | PHP / Gzip | |
| Talkative | Hack The Box | Hard | Ver 🎥 | Jamovi | |
| Tentacle | Hack The Box | Hard | Ver 🎥 | Squid / Kerberos | |
| Travel | Hack The Box | Hard | Ver 🎥 | SSRF / Gopher |
SEMANA 45: Desafíos Insane I
Enfoque: Máquinas de dificultad extrema.
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Unbalanced | Hack The Box | Hard | Ver 🎥 | Rsync / Encfs | |
| Unobtainium | Hack The Box | Hard | Ver 🎥 | Kubernetes | |
| Yummy | Hack The Box | Hard | Ver 🎥 | MVC | |
| Anubis | Hack The Box | Insane | Ver 🎥 | Container Breakout |
SEMANA 46: Desafíos Insane II
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Ariekei | Hack The Box | Insane | Ver 🎥 | Docker / Ansible | |
| Bankrobber | Hack The Box | Insane | Ver 🎥 | XSS / SQLi | |
| Bookworm | Hack The Box | Hard | Ver 🎥 | ||
| Brainfuck | Hack The Box | Insane | Ver 🎥 | Wordpress |
SEMANA 47: Desafíos Insane III
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| CTF | Hack The Box | Insane | Ver 🎥 | LDAP | |
| Fighter | Hack The Box | Hard | Ver 🎥 | ||
| Fortune | Hack The Box | Insane | Ver 🎥 | OpenBSD | |
| Fulcrum | Hack The Box | Hard | Ver 🎥 | Redis |
SEMANA 48: Desafíos Insane IV
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Hackback | Hack The Box | Insane | Ver 🎥 | XML / JSON | |
| MagicGardens | Hack The Box | Insane | Ver 🎥 | Django / SSTI | |
| Mischief | Hack The Box | Hard | Ver 🎥 | IPv6 / SNMP | |
| MultiMaster | Hack The Box | Hard | Ver 🎥 | AD / MSSQL |
SEMANA 49: Recta Final
| Estado | Máquina | Plataforma | Dificultad | Resolución | Notas |
|---|---|---|---|---|---|
| Nightmare | Hack The Box | Insane | Ver 🎥 | SQLi / Buffer Overflow | |
| Sink | Hack The Box | Insane | Ver 🎥 | HTTP Headers | |
| Stacked | Hack The Box | Insane | Ver 🎥 | XSS / LocalStack | |
| Toby | Hack The Box | Medium | Ver 🎥 | Docker / Jenkins |