Sagnik Ghosh Offensive security student writing about CTFs, penetration testing and security tooling. Writeups, projects and a timeline of my work by Sagnik Ghosh. https://sagnikbuilds.tech/ 2026-10-09T00:00:00.000Z Sagnik Ghosh Carribean: Spectronas CTF 2026 B2R https://sagnikbuilds.tech/blogs/carribean/ 2026-10-09T00:00:00.000Z The Caribbean B2R machine involves anonymous FTP enumeration, steganography, web directory discovery, cookie manipulation, and file upload exploitation to gain a shell. SSH keys recovered from an encrypted ZIP provide user access. Privilege escalation is achieved through a tar wildcard injection vulnerability in a custom backup script, leading to root access and the final flag. Amongus: Spectronas CTF 2026 B2R https://sagnikbuilds.tech/blogs/amongus/ 2026-10-08T00:00:00.000Z A complete walkthrough of the Amongus B2R machine, covering SMB and FTP enumeration, virtual host discovery, PHP Local File Inclusion (LFI), writable NFS exploitation for initial access, SSH credential discovery, and privilege escalation to root using PwnKit (CVE-2021-4034). Nexus: HTB Walkthrough https://sagnikbuilds.tech/blogs/nexus/ 2026-07-31T00:00:00.000Z A penetration test of the Nexus HTB machine, covering port scanning, virtual host enumeration, credential discovery through a Gitea instance, and initial access via a vulnerable Krayin CRM installation. Privilege escalation to root was achieved by exploiting a path traversal weakness in a root-owned Gitea template synchronization service, allowing an SSH public key to be written to root's `authorized_keys` file. Implementing Repeating-key XOR cipher https://sagnikbuilds.tech/blogs/repeating-key-xor-cipher-implementation/ 2026-04-03T00:00:00.000Z Implementing a repeating-key XOR cipher in Python: a Cryptopals Set 1 Challenge 5 writeup covering XOR basics, strings and a full implementation. Basic Pentesting 1 Walkthrough https://sagnikbuilds.tech/blogs/basic-pentesting-1/ 2026-03-24T00:00:00.000Z Basic Pentesting 1 boot2root walkthrough: Nmap recon, exploiting a vulnerable FTP service with Metasploit, and web enumeration with Gobuster. Blue TryHackMe Walkthrough https://sagnikbuilds.tech/blogs/blue/ 2025-10-21T00:00:00.000Z TryHackMe Blue walkthrough: scanning a Windows 7 host with Nmap, confirming MS17-010 (EternalBlue) and gaining a Meterpreter session with Metasploit. NetSec Challenge TryHackMe Walkthrough https://sagnikbuilds.tech/blogs/netsec/ 2025-10-21T00:00:00.000Z TryHackMe NetSec Challenge walkthrough: using Nmap to find open ports, service versions and hidden services on a target host.