Welcome to my personal cybersecurity repository! This space serves as a central hub documenting my hands-on learning journey across OverTheWire, TryHackMe, and HackTheBox. It includes step-by-step CTF writeups, machine penetration testing notes, core networking fundamentals, and Linux security cheat sheets.
- 📊 Platform Overview & Progress
- 📂 Repository Structure
- 🎮 OverTheWire - Bandit Wargame
- 🚩 TryHackMe - CTFs & Notes
- 📦 HackTheBox - Labs & Starting Point
- 🛠️ Essential Security Tools & Setup
- ⚖️ Ethical Disclaimer
| Platform | Focus Area | Status / Progress | Main Index |
|---|---|---|---|
| OverTheWire (Bandit) | Linux CLI, Encryption, Protocols, SSH | 16 / 16 Levels (Levels 0–15) |
overthewire/bandit/ |
| TryHackMe | Web Exploitation, Networking, Defensive/Offensive | 58 Rooms & Notes |
tryhackme/README.md |
| HackTheBox | Starting Point Tier 0 (Telnet, FTP, SMB, SQLi, MariaDB) | 5 / 5 Labs Completed |
hackthebox/README.md |
.
├── hackthebox/ # HackTheBox machine writeups & Starting Point Tier 0 labs
│ ├── README.md # HTB index and progress summary
│ ├── meow.md # Telnet unauthenticated access
│ ├── fawn.md # FTP anonymous access
│ ├── dancing.md # SMB guest share enumeration
│ ├── appointment.md # Web SQL Injection bypass
│ └── sequel.md # MariaDB remote database access
├── overthewire/
│ └── bandit/ # OverTheWire Bandit wargame level solutions (Levels 0 to 15)
└── tryhackme/ # TryHackMe room writeups, CTFs & fundamentals
├── README.md # Detailed THM index
├── picklerick.md # Web exploitation CTF
├── r00tme.md # SUID privilege escalation CTF
└── ... # 55+ additional topic notes & CTF guides
Bandit is a Linux-focused wargame by OverTheWire, designed to master the Linux terminal, security fundamentals, file analysis, and network communication.
- Progress:
[████████████████████] 100%(Levels 0–15 Completed) - Key Skills Covered: SSH authentication, file searching, Base64/ROT13 decoding, multi-stage archive extraction, Netcat & SSL/TLS socket connections.
- Directory Path:
overthewire/bandit/
| Level | Goal Summary | Primary Commands / Tools | Writeup Link |
|---|---|---|---|
| 0 → 1 | SSH connection & Read home directory password | ssh, ls, cat |
Bandit 0 |
| 1 → 2 | Read password from dashed filename - |
cat ./- |
Bandit 1 |
| 2 → 3 | Read password from file with spaces in name | cat "spaces in this filename" |
Bandit 2 |
| 3 → 4 | Find hidden files inside inhere directory |
ls -la |
Bandit 3 |
| 4 → 5 | Locate human-readable file among binaries | file ./* |
Bandit 4 |
| 5 → 6 | Search files by specific size, permissions & properties | find . -type f -size 1033c |
Bandit 5 |
| 6 → 7 | Find file across system by user and group ownership | find / -user bandit7 -group bandit6 |
Bandit 6 |
| 7 → 8 | Search for password line next to a target keyword | grep "millionth" |
Bandit 7 |
| 8 → 9 | Find unique line occurring only once in a file | sort, uniq -u |
Bandit 8 |
| 9 → 10 | Extract human-readable text strings from binary file | strings, grep |
Bandit 9 |
| 10 → 11 | Decode Base64 encoded string | base64 -d |
Bandit 10 |
| 11 → 12 | Decrypt ROT13 Caesar cipher | tr 'A-Za-z' 'N-ZA-Mn-za-m' |
Bandit 11 |
| 12 → 13 | Decompress nested archives (Hex dump, Gzip, Bzip2, Tar) | xxd, gzip, bzip2, tar |
Bandit 12 |
| 13 → 14 | Authenticate over SSH using an RSA Private Key | ssh -i bandit14.pkey |
Bandit 13 |
| 14 → 15 | Submit current password to local network port 30000 | nc localhost 30000 |
Bandit 14 |
| 15 → 16 | Submit password to local SSL/TLS encrypted port 30001 | openssl s_client -connect |
Bandit 15 |
TryHackMe writeups and conceptual notes covering offensive penetration testing, incident response, network protocols, and Linux administration.
- THM Profile: Amit Padhan (
amitpadhan525) - Lab Setup Guide: OpenVPN Setup
- Directory Index:
tryhackme/README.md
- 🥒 Pickle Rick - Web exploitation covering
gobusterdirectory brute-forcing, web inspection, command injection, and sudo privilege escalation. - 💀 RootMe - Web application vulnerability scanner, PHP file extension upload bypass (
.phtml), reverse shell, and SUID permission exploitation. - 🎯 Basic Pentesting - Port scanning with Nmap, SMB share enumeration, hash cracking with John the Ripper, and SSH key brute-forcing.
🔥 CTFs & Practical Challenges (Click to expand)
- Pickle Rick - Rick & Morty themed web CTF
- RootMe - Web shell & SUID exploitation
- Basic Pentesting - Enumeration & SSH cracking
- Bounty Hacker - FTP & Hydra password attack
- Crack the Hash - Hash identification & cracking
- CyberHeroes - Web authentication bypass
- Hack-For-Badge: The Game - Interactive CTF challenge
- Lofi - Web LFI (Local File Inclusion) vulnerability
- Neighbour - IDOR (Insecure Direct Object Reference)
- Oracle 9 - Web challenge walkthrough
🌐 Networking & Protocols (Click to expand)
- Introductory Networking - IP addressing, Subnetting & Routing
- OSI Model - 7 Layers of Network Communication
- DNS in Detail - Domain Name Resolution & Record Types
- HTTP in Detail - Request methods, headers & status codes
- Packets & Frames - Encapsulation & Packet structure
- Client-Server Basics - Architecture & Sockets
- What is Networking? - Core networking principles
- Networking Concepts - Topology & Protocols
- Intro to LAN - Local Area Networks & Switches
- Extending Your Network - Routers, Gateways & Port Forwarding
- OpenVPN Setup - Tunneling & VPN Configuration
- Cloud Computing Fundamentals - Cloud models (IaaS, PaaS, SaaS)
- Intro to Containerisation - Docker & Container Isolation
- Virtualisation Basics - Hypervisors & VMs
💻 Systems, OS & Architecture (Click to expand)
- Linux Fundamentals Part 1 - Essential commands & file navigation
- Linux CLI Basics - Terminal command line mastery
- Windows Basics - Windows GUI, Services & Admin tools
- Windows CLI Basics - PowerShell & Command Prompt
- Operating Systems Introduction - Kernel, Processes & Memory
- Operating System Security - Hardening & Permissions
- Inside a Computer System - Hardware, CPU & RAM
- Computer Types & Hardware - System architectures
- x86 Architecture Overview - Registers, Stack & Assembly intro
- Compiled vs Interpreted - Binary execution models
🛡️ Security Concepts & Cyber Frameworks (Click to expand)
- Cyber Kill Chain - Lockheed Martin 7-stage attack framework
- Unified Kill Chain - Modern tactical attack lifecycle
- Pyramid of Pain - Threat indicators & detection engineering
- The CIA Triad - Confidentiality, Integrity & Availability
- Defensive Security Intro - SOC, SIEM & Incident Response
- Offensive Security Intro - Penetration Testing & Ethical Hacking
- Junior Security Analyst Intro - Analyst workflows & triage
- Become a Defender - Blue Team career pathway
- Become a Hacker - Red Team career pathway
- Careers in Cyber - Cybersecurity industry roles
- Cryptography Concepts - Symmetric & Asymmetric Encryption
⚙️ Tools, Scripting & Web Fundamentals (Click to expand)
- Nmap Scanning - Port scanning flags, scripts & techniques
- Nmap Live Host Discovery - ICMP, ARP & TCP host sweeps
- How Websites Work - HTML, CSS, JS & Web Servers
- Database & SQL Basics - SQL queries & relational databases
- Data Encoding - Hex, Base64 & URL encoding
- Data Representation - Binary, Bytes & Data formats
- Python Basics - Scripting fundamentals for security
- Python Simple Demo - Python automation scripts
- Bash Scripting - Shell scripting for penetration testing
- JavaScript Simple Demo - JS client-side analysis
- Search Skills - OSINT & Google Dorking methods
- Putting It All Together - Methodological synthesis
HackTheBox infrastructure testing and vulnerable machine walkthroughs.
- HTB Profile: Amit Padhan (
amitpadhan525) - Lab Setup Guide: OpenVPN Usage Guide
- Directory Index:
hackthebox/README.md
Tier 0 covers fundamental service enumeration and exploiting default misconfigurations:
| Machine | Target Service | Vector / Vulnerability | Status | Writeup Link |
|---|---|---|---|---|
| 🐱 Meow | Port 23 (Telnet) | Unauthenticated root login | ✅ Completed | Meow |
| 🦌 Fawn | Port 21 (FTP / vsftpd) |
Anonymous login & file download | ✅ Completed | Fawn |
| 💃 Dancing | Port 445 (SMB / smbclient) |
Guest share enumeration & access | ✅ Completed | Dancing |
| 📅 Appointment | Port 80 (HTTP / Apache) | Authentication bypass via SQL Injection | ✅ Completed | Appointment |
| 🗄️ Sequel | Port 3306 (MariaDB / MySQL) | Remote database connection without password | ✅ Completed | Sequel |
These writeups utilize a standard Kali Linux / Debian penetration testing toolkit.
# Network Reconnaissance & Port Scanning
nmap -sC -sV -oA nmap/initial <TARGET_IP>
# Web Directory & File Enumeration
gobuster dir -u http://<TARGET_IP> -w /usr/share/wordlists/dirb/common.txt
# Service Banners & Socket Connections
nc -nv <TARGET_IP> <PORT>
openssl s_client -connect <TARGET_IP>:<PORT>
# SMB Share Enumeration
smbclient -L //<TARGET_IP>/ -N
# Password Hash Cracking
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txtImportant
Educational Purpose Only: All notes, scripts, and writeups in this repository are compiled strictly for educational purposes, authorized security research, and legal CTF competitions. Unethical or unauthorized hacking against targets without explicit prior consent is illegal. Always practice responsible disclosure and strictly test within authorized lab environments (e.g. OverTheWire, TryHackMe, HackTheBox).
Amit Padhan
- 🐙 GitHub: @amitpadhan525
- 🚩 TryHackMe: amitpadhan525
- 📦 HackTheBox: amitpadhan525
⭐ If you find these notes helpful, feel free to star the repository!