Hands-on security research and Hack The Box write-ups by Ilias Georgopoulos: controlled labs, detection engineering, exploitation and lessons learned.https://ilias1988.me/en-ushttps://ilias1988.me/writeups/hackthebox/machines/mailroom/https://ilias1988.me/writeups/hackthebox/machines/mailroom/A practical Mailroom walkthrough chaining stored XSS, internal SSRF, MongoDB injection, container command injection, and KeePass keystroke capture.Fri, 04 Sep 2026 00:00:00 GMTstored-xssssrfnosql-injectionmongodbsource-code-reviewcommand-injectiondockerlateral-movementkeepasslinux-privilege-escalationhttps://ilias1988.me/labs/windows/scf-forced-ntlm-authentication-detection/https://ilias1988.me/labs/windows/scf-forced-ntlm-authentication-detection/A controlled SCF-file lab for testing remote icon-triggered NTLM authentication, separating legacy Chrome behavior from current Windows exposure and defensive telemetry.Thu, 03 Sep 2026 12:00:00 GMTSCFForced AuthenticationNetNTLMv2Windows ExplorerSMBResponderDetection Engineeringhttps://ilias1988.me/writeups/hackthebox/machines/caption/https://ilias1988.me/writeups/hackthebox/machines/caption/Caption chains Git history, Varnish cache poisoning, XSS, H2C smuggling, copyparty traversal and Apache Thrift command injection for root access.Thu, 03 Sep 2026 00:00:00 GMTweb-cache-poisoningweb-cache-deceptionxssrequest-smugglingh2cssrfpath-traversalcommand-injectionlinux-privilege-escalationgitbucketvarnishhaproxyapache-thrifthttps://ilias1988.me/labs/windows/bruteforcing-windows-defender-exclusions/https://ilias1988.me/labs/windows/bruteforcing-windows-defender-exclusions/A validated Windows lab showing how MpCmdRun.exe reveals a Defender-excluded directory through a distinctive skipped-scan response, with detection and mitigation guidance.Wed, 02 Sep 2026 10:00:00 GMTMicrosoft DefenderMpCmdRunAV ExclusionsWindows SecuritySecurity ResearchDetection EngineeringLiving off the Landhttps://ilias1988.me/writeups/hackthebox/machines/validation/https://ilias1988.me/writeups/hackthebox/machines/validation/Validation turns a stored SQL injection into MySQL FILE abuse, a PHP web shell, a www-data foothold, and root through reused database credentials.Wed, 02 Sep 2026 00:00:00 GMTweb-securitysql-injectionmysqlinformation-schemafile-privilegephp-webshellpassword-reuseprivilege-escalationhttps://ilias1988.me/labs/windows/mark-of-the-web-forensics-tracing-download-origins/https://ilias1988.me/labs/windows/mark-of-the-web-forensics-tracing-download-origins/A practical Windows forensics blueprint for inspecting Zone.Identifier metadata, tracing download origins, testing Unblock behavior and monitoring MOTW creation.Wed, 02 Sep 2026 00:00:00 GMTMark of the WebMOTWZone.IdentifierNTFS ADSWindows ForensicsSmartScreenDigital Forensicshttps://ilias1988.me/labs/red-team/sliver-netsh-helper-dll-persistence-detection/https://ilias1988.me/labs/red-team/sliver-netsh-helper-dll-persistence-detection/A validated red-team lab combining Sliver staging with a custom Netsh Helper DLL, event-triggered persistence and Microsoft Defender detection analysis.Tue, 01 Sep 2026 07:00:00 GMTSliver C2Netsh Helper DLLWindows PersistencemTLSStagingC++Microsoft DefenderDetection EngineeringMITRE ATT&CKhttps://ilias1988.me/labs/network/dns-txt-powershell-command-retrieval-staging-detection/https://ilias1988.me/labs/network/dns-txt-powershell-command-retrieval-staging-detection/A controlled lab that stores a harmless PowerShell instruction in DNS TXT, retrieves and validates it from Windows, then studies DNS, process and script telemetry.Tue, 01 Sep 2026 06:00:00 GMTDNSTXT RecordsPowerShellDetection EngineeringScript Block LoggingSysmonStagingNetwork Telemetryhttps://ilias1988.me/writeups/hackthebox/machines/soccer/https://ilias1988.me/writeups/hackthebox/machines/soccer/A practical Hack The Box Soccer walkthrough covering Tiny File Manager RCE, blind WebSocket SQL injection, SSH access, and doas/dstat privilege escalation.Tue, 01 Sep 2026 00:00:00 GMTweb-enumerationdefault-credentialsfile-uploadremote-code-executionwebsocketblind-sql-injectionsshdoasdstatprivilege-escalationhttps://ilias1988.me/labs/windows/lnk-hta-polyglot-code-execution-detection-persistence/https://ilias1988.me/labs/windows/lnk-hta-polyglot-code-execution-detection-persistence/A controlled Windows research lab that builds a benign LNK–HTA polyglot, studies its execution chain, maps forensic telemetry and tests safe Startup persistence.Tue, 01 Sep 2026 00:00:00 GMTLNKHTAMSHTAWindowsDetection EngineeringPersistenceDigital ForensicsPolyglot Fileshttps://ilias1988.me/writeups/hackthebox/machines/ghost/https://ilias1988.me/writeups/hackthebox/machines/ghost/A hands-on Ghost lab journal: LDAP injection, Gitea source review, Linux and Kerberos pivots, Golden SAML, linked MSSQL, in-memory privilege escalation and forest compromise.Mon, 31 Aug 2026 00:00:00 GMTactive-directoryldap-injectionpath-traversalcommand-injectionkerberosgmsagolden-samllinked-mssqldomain-trustgolden-tickethttps://ilias1988.me/writeups/hackthebox/machines/nodeblog/https://ilias1988.me/writeups/hackthebox/machines/nodeblog/Hack The Box NodeBlog walkthrough: JSON NoSQL injection, XXE source disclosure, node-serialize RCE, an admin shell, and sudo privilege escalation.Mon, 31 Aug 2026 00:00:00 GMTnodejsexpressnosql-injectionmongodbxxeinsecure-deserializationremote-code-executionsudo