{"site":{"name":"writeups.es","url":"https://www.writeups.es","description":"La comunidad hispanohablante de writeups de CTF. Walkthroughs paso a paso de máquinas de Hack The Box, TryHackMe, VulnHub, DockerLabs y más, escritos por hackers y libres de leer.","language":"es","license":"CC BY-SA 4.0"},"generated_at":"2026-09-28T17:20:00.888Z","count":16,"writeups":[{"url":"https://www.writeups.es/writeups/hackthebox/web-attacks-skills-assessment/juanluismm520","markdown_url":"https://www.writeups.es/writeups/hackthebox/web-attacks-skills-assessment/juanluismm520.md","json_url":"https://www.writeups.es/writeups/hackthebox/web-attacks-skills-assessment/juanluismm520.json","machine":"Web Attacks - Skills Assessment","platform":"HackTheBox","author":"juanluismm520","author_url":"https://www.writeups.es/u/juanluismm520","difficulty":"medio","difficulty_label":"Medio","operating_system":["Linux","Web"],"tags":["web","idor","xxe","tampering"],"summary":"Máquina que hay que encadenar, idor, con enumeración de usuarios, buscar al admin, cambiarle la contraseña mediante verb tampering y crear un evento vulenrable a XXE.","published_at":"2026-09-27T15:40:49.215366+00:00","updated_at":"2026-09-28T16:59:11.748949+00:00"},{"url":"https://www.writeups.es/writeups/portswigger/explotando-un-api-endpoint-usando-documentacion/juanluismm520","markdown_url":"https://www.writeups.es/writeups/portswigger/explotando-un-api-endpoint-usando-documentacion/juanluismm520.md","json_url":"https://www.writeups.es/writeups/portswigger/explotando-un-api-endpoint-usando-documentacion/juanluismm520.json","machine":"Explotando un API endpoint usando documentación","platform":"PortSwigger Web Security Academy","author":"juanluismm520","author_url":"https://www.writeups.es/u/juanluismm520","difficulty":"facil","difficulty_label":"Fácil","operating_system":["Linux"],"tags":["web"],"summary":"Tienes la documentación de una API al completo, debemos ver su lógica para ver como explotarla.","published_at":"2026-05-24T16:36:54.881889+00:00","updated_at":"2026-09-24T11:33:39.40751+00:00"},{"url":"https://www.writeups.es/writeups/hackthebox/skills-assessment-broken-authentication/juanluismm520","markdown_url":"https://www.writeups.es/writeups/hackthebox/skills-assessment-broken-authentication/juanluismm520.md","json_url":"https://www.writeups.es/writeups/hackthebox/skills-assessment-broken-authentication/juanluismm520.json","machine":"Skills Assessment - Broken Authentication","platform":"HackTheBox","author":"juanluismm520","author_url":"https://www.writeups.es/u/juanluismm520","difficulty":"facil","difficulty_label":"Fácil","operating_system":["Linux","Web"],"tags":["web","auth","bruteforce","enum"],"summary":null,"published_at":"2026-09-14T16:10:24.412421+00:00","updated_at":"2026-09-24T11:02:45.419849+00:00"},{"url":"https://www.writeups.es/writeups/hackthebox/openadmin/juanluismm520","markdown_url":"https://www.writeups.es/writeups/hackthebox/openadmin/juanluismm520.md","json_url":"https://www.writeups.es/writeups/hackthebox/openadmin/juanluismm520.json","machine":"OpenAdmin","platform":"HackTheBox","author":"juanluismm520","author_url":"https://www.writeups.es/u/juanluismm520","difficulty":"medio","difficulty_label":"Medio","operating_system":["Linux","Web"],"tags":["web","linux","privesc","ssh","lateral","rce"],"summary":null,"published_at":"2026-09-10T15:30:43.952149+00:00","updated_at":"2026-09-10T17:24:22.061498+00:00"},{"url":"https://www.writeups.es/writeups/hackthebox/bountyhunter/juanluismm520","markdown_url":"https://www.writeups.es/writeups/hackthebox/bountyhunter/juanluismm520.md","json_url":"https://www.writeups.es/writeups/hackthebox/bountyhunter/juanluismm520.json","machine":"BountyHunter","platform":"HackTheBox","author":"juanluismm520","author_url":"https://www.writeups.es/u/juanluismm520","difficulty":"facil","difficulty_label":"Fácil","operating_system":["Linux","Web"],"tags":["web","ssh","linux","privesc"],"summary":null,"published_at":"2026-09-08T15:45:00.980331+00:00","updated_at":"2026-09-09T15:33:35.920566+00:00"},{"url":"https://www.writeups.es/writeups/hackthebox/bashed/juanluismm520","markdown_url":"https://www.writeups.es/writeups/hackthebox/bashed/juanluismm520.md","json_url":"https://www.writeups.es/writeups/hackthebox/bashed/juanluismm520.json","machine":"Bashed","platform":"HackTheBox","author":"juanluismm520","author_url":"https://www.writeups.es/u/juanluismm520","difficulty":"muy_facil","difficulty_label":"Muy fácil","operating_system":["Linux","Web"],"tags":["web","fuzzing","e","escalation"],"summary":"Máquina enfocada en web fuzzing para desubrir ficheros de desarrollo que pueden contener información sensible.","published_at":"2026-09-07T16:31:15.102663+00:00","updated_at":"2026-09-08T15:04:53.52115+00:00"},{"url":"https://www.writeups.es/writeups/hackthebox/skills-assessment-brute-force/juanluismm520","markdown_url":"https://www.writeups.es/writeups/hackthebox/skills-assessment-brute-force/juanluismm520.md","json_url":"https://www.writeups.es/writeups/hackthebox/skills-assessment-brute-force/juanluismm520.json","machine":"Skills Assessment - Brute Force","platform":"HackTheBox","author":"juanluismm520","author_url":"https://www.writeups.es/u/juanluismm520","difficulty":"muy_facil","difficulty_label":"Muy fácil","operating_system":["Linux"],"tags":["brute-force","web","hydra","ssh","ftp","linux"],"summary":"Debemos atacar dos laboratorios relacionados en los que debemos explotar ataques de fuerza bruta a partir de diccionarios dados.","published_at":"2026-09-03T15:19:58.866865+00:00","updated_at":"2026-09-06T16:15:58.893562+00:00"},{"url":"https://www.writeups.es/writeups/bug-bounty/vdp-hagalink/WaterRessistan","markdown_url":"https://www.writeups.es/writeups/bug-bounty/vdp-hagalink/WaterRessistan.md","json_url":"https://www.writeups.es/writeups/bug-bounty/vdp-hagalink/WaterRessistan.json","machine":"VDP Hagalink","platform":"Bug Bounty","author":"WaterRessistan","author_url":"https://www.writeups.es/u/WaterRessistan","difficulty":"medio","difficulty_label":"Medio","operating_system":["Web"],"tags":["web","openredirect","vdp","bugbounty","burpsuite"],"summary":null,"published_at":"2026-05-28T15:54:17.907853+00:00","updated_at":"2026-09-03T19:40:21.797085+00:00"},{"url":"https://www.writeups.es/writeups/hackthebox/skills-assessment-server-side-attacks/juanluismm520","markdown_url":"https://www.writeups.es/writeups/hackthebox/skills-assessment-server-side-attacks/juanluismm520.md","json_url":"https://www.writeups.es/writeups/hackthebox/skills-assessment-server-side-attacks/juanluismm520.json","machine":"Skills Assessment - Server-Side Attacks","platform":"HackTheBox","author":"juanluismm520","author_url":"https://www.writeups.es/u/juanluismm520","difficulty":"medio","difficulty_label":"Medio","operating_system":["Web","Linux"],"tags":["web","ssrf","lateral","server-side"],"summary":"Máquina final del módulo de Server-Side Attacks del path para la certificación CWES. En ella vemos claramente un SSRF y posiblemente más elementos que sean interesantes.","published_at":"2026-08-29T14:55:13.789843+00:00","updated_at":"2026-08-29T15:41:26.413426+00:00"},{"url":"https://www.writeups.es/writeups/hackthebox/skills-assessment-file-upload-attacks/juanluismm520","markdown_url":"https://www.writeups.es/writeups/hackthebox/skills-assessment-file-upload-attacks/juanluismm520.md","json_url":"https://www.writeups.es/writeups/hackthebox/skills-assessment-file-upload-attacks/juanluismm520.json","machine":"Skills Assessment - File Upload Attacks","platform":"HackTheBox","author":"juanluismm520","author_url":"https://www.writeups.es/u/juanluismm520","difficulty":"medio","difficulty_label":"Medio","operating_system":["Linux"],"tags":["web","lfi"],"summary":"Nos dan una web vulnerable a File Upload, debemos usar todo lo dado en el módulo para conseguirlo.","published_at":"2026-08-23T15:53:56.249509+00:00","updated_at":"2026-08-23T16:09:28.092861+00:00"},{"url":"https://www.writeups.es/writeups/dockerlabs/race/juanluismm520","markdown_url":"https://www.writeups.es/writeups/dockerlabs/race/juanluismm520.md","json_url":"https://www.writeups.es/writeups/dockerlabs/race/juanluismm520.json","machine":"Race","platform":"DockerLabs","author":"juanluismm520","author_url":"https://www.writeups.es/u/juanluismm520","difficulty":"medio","difficulty_label":"Medio","operating_system":["Linux"],"tags":["web","ssh"],"summary":null,"published_at":"2026-06-15T16:44:44.392355+00:00","updated_at":"2026-08-18T09:43:40.567392+00:00"},{"url":"https://www.writeups.es/writeups/portswigger/auth-bypass-info-disclosure/juanluismm520","markdown_url":"https://www.writeups.es/writeups/portswigger/auth-bypass-info-disclosure/juanluismm520.md","json_url":"https://www.writeups.es/writeups/portswigger/auth-bypass-info-disclosure/juanluismm520.json","machine":"Auth Bypass Info Disclosure","platform":"PortSwigger Web Security Academy","author":"juanluismm520","author_url":"https://www.writeups.es/u/juanluismm520","difficulty":"muy_facil","difficulty_label":"Muy fácil","operating_system":["Web"],"tags":["web","information-disclosure"],"summary":null,"published_at":"2026-06-08T18:02:04.811496+00:00","updated_at":"2026-08-17T08:09:20.082091+00:00"},{"url":"https://www.writeups.es/writeups/dockerlabs/duque/WaterRessistan","markdown_url":"https://www.writeups.es/writeups/dockerlabs/duque/WaterRessistan.md","json_url":"https://www.writeups.es/writeups/dockerlabs/duque/WaterRessistan.json","machine":"Duque","platform":"DockerLabs","author":"WaterRessistan","author_url":"https://www.writeups.es/u/WaterRessistan","difficulty":"facil","difficulty_label":"Fácil","operating_system":["Linux"],"tags":["web","fuzzing","linux","sqli"],"summary":null,"published_at":"2026-05-23T16:37:20.078891+00:00","updated_at":"2026-08-17T08:09:20.082091+00:00"},{"url":"https://www.writeups.es/writeups/hackthebox/skills-assessment-xss-cwes-htb-academy/juanluismm520","markdown_url":"https://www.writeups.es/writeups/hackthebox/skills-assessment-xss-cwes-htb-academy/juanluismm520.md","json_url":"https://www.writeups.es/writeups/hackthebox/skills-assessment-xss-cwes-htb-academy/juanluismm520.json","machine":"Skills Assessment (XSS CWES HTB Academy)","platform":"HackTheBox","author":"juanluismm520","author_url":"https://www.writeups.es/u/juanluismm520","difficulty":"facil","difficulty_label":"Fácil","operating_system":["Web"],"tags":["web","xss"],"summary":null,"published_at":"2026-07-09T17:40:26.868174+00:00","updated_at":"2026-08-17T08:09:20.082091+00:00"},{"url":"https://www.writeups.es/writeups/portswigger/url-based-access-control-can-be-circumvented/juanluismm520","markdown_url":"https://www.writeups.es/writeups/portswigger/url-based-access-control-can-be-circumvented/juanluismm520.md","json_url":"https://www.writeups.es/writeups/portswigger/url-based-access-control-can-be-circumvented/juanluismm520.json","machine":"URL-based access control can be circumvented","platform":"PortSwigger Web Security Academy","author":"juanluismm520","author_url":"https://www.writeups.es/u/juanluismm520","difficulty":"facil","difficulty_label":"Fácil","operating_system":["Linux","Web"],"tags":["web"],"summary":null,"published_at":"2026-06-08T18:35:40.801795+00:00","updated_at":"2026-08-17T08:09:20.082091+00:00"},{"url":"https://www.writeups.es/writeups/portswigger/acceso-a-posts-graphql-privados/juanluismm520","markdown_url":"https://www.writeups.es/writeups/portswigger/acceso-a-posts-graphql-privados/juanluismm520.md","json_url":"https://www.writeups.es/writeups/portswigger/acceso-a-posts-graphql-privados/juanluismm520.json","machine":"Acceso a posts GraphQL privados","platform":"PortSwigger Web Security Academy","author":"juanluismm520","author_url":"https://www.writeups.es/u/juanluismm520","difficulty":"facil","difficulty_label":"Fácil","operating_system":["Linux"],"tags":["web","graphql"],"summary":null,"published_at":"2026-05-24T17:06:46.758048+00:00","updated_at":"2026-08-17T08:09:20.082091+00:00"}]}