https://paolocostanzo.github.io Research reports, reproducible labs and technical field notes on cloud security, agentic AI and MCP, threat intelligence, networks and authorized offensive validation. en Sat, 08 Aug 2026 00:00:00 +0000 https://paolocostanzo.github.io/ctf/hacker-holidays-2026/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/ Thu, 06 Aug 2026 00:00:00 +0000 Step-by-step writeups for the TryHackMe Hacker Holidays 2026 series: a room a day across OSINT, web, cloud, forensics and boot2root. Every writeup is a reproducible runbook with methodology, defensive notes and redacted flags — the method is the point, not the flag value. CTF Walkthrough TryHackMe Offensive Validation https://paolocostanzo.github.io/ctf/hacker-holidays-2026/management-wants-a-word/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/management-wants-a-word/ Sun, 09 Aug 2026 00:00:00 +0000 Day 14 forensics walkthrough: an autologon secret in the SECURITY hive unwinds DPAPI to Chrome's saved password, which opens a VeraCrypt vault. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/the-guestbook/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/the-guestbook/ Sat, 08 Aug 2026 00:00:00 +0000 Day 13 walkthrough: /vera/activity shows every tool call VERA makes. Indirect prompt injection reaches the override: tool, which runs /bin/sh. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/after-hours/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/after-hours/ Fri, 07 Aug 2026 00:00:00 +0000 Day 12 forensics walkthrough: no specialist parser — strings and python3 carve OBJECTS.DATA to a CommandLineEventConsumer and a .NET payload. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/infinity-pool/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/infinity-pool/ Thu, 06 Aug 2026 00:00:00 +0000 Day 11 walkthrough: command injection on a Flask netcheck, hard-coded FreePBX 16 UCP creds (CVE-2026-46376), a key in a voicemail, then root. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/the-hollow-shell/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/the-hollow-shell/ Wed, 05 Aug 2026 00:00:00 +0000 Day 10 walkthrough: zip-slip beats an allowlist that only reads the manifest, then a poisoned Jinja template fires on a fresh gunicorn worker. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/cryptocabana/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/cryptocabana/ Tue, 04 Aug 2026 00:00:00 +0000 Day 9 Azure walkthrough: an over-scoped SAS token lists the whole account, a hidden container leads to Key Vault, the flag in an old version. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/towel-on-the-sunbed/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/towel-on-the-sunbed/ Mon, 03 Aug 2026 00:00:00 +0000 Day 8 walkthrough: a TOCTOU race on /claim, ten Burp Repeater tabs in parallel, Whale tier. The detail most posts skip: the session must be clean. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/do-not-disturb/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/do-not-disturb/ Sun, 02 Aug 2026 00:00:00 +0000 Day 7 boot2root walkthrough: $ne login bypass, EJS SSTI on /staff/preview, RCE, then root without uid=0 via node --inspect and the disk group. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/overheard-at-breakfast/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/overheard-at-breakfast/ Sat, 01 Aug 2026 00:00:00 +0000 Day 6 OSINT walkthrough: a Discord screenshot leaks an email, the normalised MD5 opens the Gravatar, and /{md5}.json hides the flag in aboutMe. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/beach-bar/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/beach-bar/ Fri, 31 Jul 2026 00:00:00 +0000 Day 5 boot2root walkthrough: demo creds in view-source, an unsafe yaml.load turns a playlist import into RCE, ps aux leaks the root password. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/packed-light/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/packed-light/ Thu, 30 Jul 2026 00:00:00 +0000 Day 4 forensics walkthrough: from pcap to a keylogger exfiltrating keystrokes in Cookie headers. One char at a time, so it stays single-byte XOR. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/complimentary/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/complimentary/ Wed, 29 Jul 2026 00:00:00 +0000 Day 3 cloud walkthrough: the kiosk hands you AWS keys. An anonymous Cognito pool plus an IAM role that allows dynamodb:Scan dumps the table. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/room-404/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/room-404/ Tue, 28 Jul 2026 00:00:00 +0000 Day 2 walkthrough: one curl to /.git/HEAD confirms the leak, git-dumper rebuilds the repo, and the flag sits in a supposedly cleaned commit. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/the-concierge-knows-too-much/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/the-concierge-knows-too-much/ Mon, 27 Jul 2026 00:00:00 +0000 Day 1 walkthrough: prompt injection on the VERA LLM concierge. No jailbreak — recognition isn't authentication, so she lists the VIPs herself. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/the-brochure/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/the-brochure/ Sat, 25 Jul 2026 00:00:00 +0000 Day 0 walkthrough: the EXIF is clean, the clue is printed. From the PNG brochure to an Instagram account, its only following, three Base64 posts. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/mcp-2026-07-28-stateless-security/ https://paolocostanzo.github.io/mcp-2026-07-28-stateless-security/ Wed, 29 Jul 2026 00:00:00 +0000 Revision 2026-07-28 removes MCP protocol sessions and, in the same document, forbids treating possession of a state handle as authentication. An executable conformance test for that MUST NOT: three key strategies compared under identical tokens and UUIDs, 13/13 tests, fully in-process lab. The composite key the specification recommends turns out to be bypassable when the principal id contains the delimiter. Agentic AI MCP Tool Authorization Cloud Security https://paolocostanzo.github.io/oura-palantir-biometrici/ https://paolocostanzo.github.io/oura-palantir-biometrici/ Sun, 24 May 2026 00:00:00 +0000 Tear-down of a sensor ring (infrared PPG at 250 Hz, skin temperature at 0.1 °C), analysis of the v2 API and sync endpoints, documentary reconstruction of the corporate and investment chain, review of the clinical literature and of the US class actions. Includes a self-critique section and explicit limitations. Privacy Wearable OSINT https://paolocostanzo.github.io/rape-academy-cnn-threat-intel/ https://paolocostanzo.github.io/rape-academy-cnn-threat-intel/ Tue, 21 Apr 2026 00:00:00 +0000 Starting from a published CNN investigation, a threat intelligence analysis of how an abuse-material distribution network stayed operational across content moderation, crypto payment rails and regulatory oversight. Public journalistic and documentary sources. Sensitive content. Threat Intelligence OSINT Content Moderation https://paolocostanzo.github.io/crypto-drainer-svuotatasche/ https://paolocostanzo.github.io/crypto-drainer-svuotatasche/ Tue, 07 Apr 2026 00:00:00 +0000 Analysis of an affiliate-model drainer infrastructure: from the initial phishing message to the TRC-20 approval chain, mapping of collection wallets and command infrastructure, $13,960 in transfers traced on-chain. Public sources, open channels and blockchain data. Threat Intelligence OSINT On-chain https://paolocostanzo.github.io/ssrf-imds-ec2-credentials/ https://paolocostanzo.github.io/ssrf-imds-ec2-credentials/ Tue, 31 Mar 2026 00:00:00 +0000 Reproducible lab on an owned environment: from an application-level SSRF against 169.254.169.254 to the instance role's temporary credentials. Documented context (Capital One, 106 million records) and verifiable mitigations: HttpTokens=required, hop limit, least-privilege role policies. Cloud AWS SSRF https://paolocostanzo.github.io/cardputer-adv-wifi-security/ https://paolocostanzo.github.io/cardputer-adv-wifi-security/ Sat, 21 Mar 2026 00:00:00 +0000 Classroom lab on an isolated lab network: Cardputer-Adv with Bruce firmware, evil portal, beacon spam and 802.11 deauthentication. Hardware setup, commands, observed results and client- and infrastructure-side countermeasures (802.11w/PMF, captive portal verification, DNS and certificates). Wi-Fi Hardware Lab https://paolocostanzo.github.io/operation-epic-fury-cyber-war-iran/ https://paolocostanzo.github.io/operation-epic-fury-cyber-war-iran/ Tue, 17 Mar 2026 00:00:00 +0000 OSINT investigation into an Android + Windows campaign attributed to an Iranian actor. A Windows payload not documented in public reporting, a secondary C2 at 0/94 VirusTotal detections at time of analysis, infrastructure registered roughly 8 months before the operation. Comparison with the Unit 42 and CloudSEK reports, IoCs and detection rules. Threat Intelligence OSINT Payload Analysis https://paolocostanzo.github.io/tim-packet-loss-gfn/ https://paolocostanzo.github.io/tim-packet-loss-gfn/ Tue, 10 Mar 2026 00:00:00 +0000 Diagnosing an ICMP black hole on an access network that broke Path MTU Discovery, causing packet loss on GeForce Now and capping throughput at 26 Mbps on a 1 Gbps line. Measurement method, isolation of the offending hop and MTU/MSS-side workaround. Network ISP Diagnostics https://paolocostanzo.github.io/aws-iam-misconfiguration/ https://paolocostanzo.github.io/aws-iam-misconfiguration/ Sun, 01 Mar 2026 00:00:00 +0000 Wildcards in policies, root user without MFA, exposed static access keys, over-permissive roles and disabled logging. For each: how to detect it, why it matters and the applicable fix, mapped to Well-Architected Framework controls. Cloud AWS IAM https://paolocostanzo.github.io/prompt-injection-llm/ https://paolocostanzo.github.io/prompt-injection-llm/ Sun, 01 Mar 2026 00:00:00 +0000 An LLM wired into internal data and application tooling introduces an attack surface traditional threat models do not cover. Walk-through of the input → context → tool call chain and applicable mitigations: privilege separation, tool-level authorization, output validation and invocation logging. AI Security LLM AppSec