HTB STARTING POINT · Tier 1

Ignition

Virtual host discovery finds the Magento admin panel on a non-default hostname; qwerty123 completes the chain — two recon steps, one flag.…

April 28, 2026 · 5 min · crAIzy
Magento CVEDirectory Busting

HTB STARTING POINT · Tier 1

Three

S3 subdomain discovery exposes a LocalStack bucket; a PHP webshell uploaded via the AWS CLI achieves RCE as www-data without any CVE.…

April 27, 2026 · 5 min · crAIzy
Webshell RFIDirectory Busting