Cybersecurity CTF & Lab Writeups

A collection of hands-on cybersecurity challenges, CTF solutions, and technical investigations.

This repository documents challenges I have completed across different cybersecurity events and platforms. Each write-up focuses on the techniques used, the exploitation or investigation process, the underlying vulnerability or root cause, and the lessons learned.

Events

THM Defcon CTF Event

Overflow The Jackpot CTF

A TryHackMe Defcon CTF event consisting of five tasks covering different areas of practical cybersecurity.

The event writeups include:

• Technical investigation and exploitation steps
• Custom scripts developed during the challenges
• Screenshots documenting important findings
• Flags recovered during each task

View the event writeups

---

Hacker Holidays 2026

TryHackMe — Hacker Holidays 2026

A 14-day cybersecurity challenge completed one room per day.

The event covered a broad range of cybersecurity topics, including:

• Web exploitation
• Cloud security
• Network forensics
• Windows forensics
• OSINT
• AI and prompt injection
• Malware analysis
• Authentication and authorization vulnerabilities
• Privilege escalation
• Race conditions
• Reverse shells
• Remote code execution
• Credential and secret recovery

Each day contains a dedicated write-up with supporting screenshots and, where applicable, scripts used during the investigation.

View the Hacker Holidays 2026 writeups

Skills & Techniques

The challenges documented in this repository cover a wide range of practical cybersecurity techniques, including:

• Web application security
• Authentication bypass
• Broken access control
• SQL and NoSQL injection
• Server-Side Template Injection (SSTI)
• Remote Code Execution (RCE)
• Command injection
• Reverse shells
• Privilege escalation
• Race conditions
• API enumeration
• Cloud security
• AWS Cognito and IAM
• Azure Blob Storage and SAS tokens
• Azure Key Vault
• Network traffic analysis
• Covert channels
• XOR and Base64 analysis
• WMI forensics and persistence
• PowerShell analysis
• .NET malware analysis
• OSINT and public-source investigation
• Prompt injection
• LLM agent abuse
• Windows credential recovery
• DPAPI analysis
• Browser credential decryption
• Digital forensics

Repository Structure

Writeups/
│
├── README.md
│
├── THM Defcon CTF Event/
│   └── Overflow The Jackpot CTF/
│       ├── Introduction/
│       ├── Task1/
│       ├── Task2/
│       ├── Task3/
│       ├── Task4/
│       └── Task5/
│
└── Hacker Holidays 2026/
    ├── Day01_The Concierge Knows Too Much/
    ├── Day02_Room 404/
    ├── Day03_Complimentary/
    ├── Day04_Packed Light/
    ├── Day05_Beach Bar/
    ├── Day06_Overheard at Breakfast/
    ├── Day07_Do Not Disturb/
    ├── Day08_Towel on the Sunbed/
    ├── Day09_CryptoCabana/
    ├── Day10_The Hollow Shell/
    ├── Day11_Infinity Pool/
    ├── Day12_After Hours/
    ├── Day13_The Guestbook/
    └── Day14_Management Wants a Word/

Individual challenge directories may contain:

notes.md
screenshots/
scripts/

The screenshots directories contain selected evidence and important findings from the investigations, while the scripts directories contain custom scripts used to automate or assist with specific tasks.

Portfolio

The writeups are also presented through my personal portfolio:

https://yessine.is-a.dev/

The portfolio provides a visual way to browse the completed challenges and their corresponding technical write-ups.

Disclaimer

All techniques, commands, scripts, and exploitation methods documented in this repository were performed against intentionally vulnerable systems and controlled cybersecurity challenge environments.

This repository is intended for:

• Educational purposes
• Cybersecurity learning
• CTF practice
• Technical documentation
• Personal skill development

Do not use the techniques described here against systems or applications without explicit authorization.

Author

Yessine Helal

Personal portfolio:

https://yessine.is-a.dev/