Recon to root.

ctxzero, penetration tester and security researcher

I'm Luis Schlegel. I break web applications, networks and Active Directory by hand, then write down every step so it can be reproduced and fixed.

Read the advisory Browse writeups
CVE-2026-106933Disclosure
CPTS, CWES, eJPTCertified
v1oletCTF co-captain

Disclosures

Vulnerabilities I found and reported through coordinated disclosure. Proof-of-concept details stay private until the vendor or database releases them.

CVE-2026-106933 Medium, 6.8 No fix available Verified by WPScan

Blaze Demo Importer ≤ 1.0.16

Stored cross-site scripting through SVG upload, reachable from the Author role.

The WordPress plugin registers the SVG MIME type for the media library unconditionally and never sanitises uploaded SVG files. Any account with the Author role or higher can upload a crafted SVG that runs JavaScript in the browser of whoever opens the file, including administrators.

Plugin
blaze-demo-importer
Affected
1.0.16 and earlier
Weakness
CWE-79, cross-site scripting
Credit
Luis Schlegel (ctxzero)
6.8/ 10
CVSS 3.1 base score
Medium severity
Attack vectorNetwork
ComplexityLow
PrivilegesHigh
User interactionRequired
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
ScopeUnchanged
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
  1. Found and reportedSubmitted to WPScan by Luis Schlegel
  2. Verified, CVE assignedAdded to the WPScan database, October 2026
  3. Proof of concept publicHeld back until 30 October 2026

Mitigation: no patched release exists yet. Deactivate and remove the plugin, or restrict who holds Author-level accounts and block SVG uploads until a fix ships.

Read on WPScan CVE record

WPVDB 4f85834c-30e4-451f-9616-70dc8eaf9c41

About

Luis Schlegel, ctxzero online. Based in Europe, working across web application, network and Active Directory security.

A scanner flag is a starting point, not a finding. What matters is why something is exploitable, what it chains into, and what it costs when someone walks that path end to end.

I work manual-first and back it with the right tooling. Everything I learn ends up in two places: writeups that document the full route from recon to root, and tools I build when the existing option is too slow or too loud.

Right now I'm pushing deeper into web application security and vulnerability research, and starting to work the other side of the fence, blue team and forensics, because knowing how detection fails makes for better offense.

Focus
Web, network, Active Directory
Approach
Enumerate everything. Verify by hand. Prove impact.
Research
WordPress plugin security
Currently
Moving into blue team and forensics
Team
Co-captain at v1olet
Status
Open to opportunities
0
Machines documented
0
Certifications
0
CVE credited
0nd
Best CTF finish, twice

What I test

Grouped the way an engagement runs. Every item is something I've used against a real target, not a line from a syllabus.

SQL injectionUnion, boolean, time-based and out-of-band. Found by hand, automated only to speed up extraction.
Cross-site scriptingReflected, stored and DOM-based, carried through to a real impact demo, not an alert box.
File uploadExtension, content-type and parser bypasses that end in code execution or stored XSS.
SSRFInternal service reach, cloud metadata and protocol smuggling out of one trusted fetch.
IDOR and BOLAObject and function level access control tested across every role the app defines.
Auth bypassSession handling, JWT flaws, reset logic and multi-step flows that trust the wrong step.
SSTITemplate engine detection, then escalation from expression evaluation to RCE.
Command injectionArgument and metacharacter injection, including blind and filtered variants.
LFI and traversalTraversal into source disclosure, log poisoning and file-read-to-RCE chains.
Prototype pollutionPolluting Object.prototype to reach a gadget the application never meant to expose, client and server side.
PHP object injectionUnserialize on attacker-controlled input, then a POP chain through the app's own classes to RCE.
And moreDeserialisation beyond PHP, CORS and cache poisoning, request smuggling, XXE, race conditions, business-logic abuse.
BloodHoundGraph the domain and find the shortest honest path from foothold to Domain Admin.
KerberoastingPulling service tickets for SPN accounts and cracking them offline, no noise on the wire.
AS-REP roastingHarvesting hashes from accounts that never required Kerberos pre-authentication.
NTLM relayCoercing authentication and relaying it to a service that forgot to require signing.
ADCS abuseCertificate template misconfiguration, ESC1 through ESC8, into domain-wide authentication.
DCSyncReplicating the directory to pull every hash in the domain once the rights are there.
Delegation abuseUnconstrained, constrained and resource-based delegation turned into impersonation.
ACL abuseGenericAll, WriteDACL and friends: the ACL edges nobody audits after a migration.
And moreSilver and golden tickets, shadow credentials, GPO abuse, LAPS and gMSA reads, trust and cross-forest paths.
Service enumerationEvery service, every version, every default credential, before anything gets exploited.
SMB and RPCShare hunting, null sessions, RPC enumeration and everything they leak about the domain.
PivotingTurning one compromised host into a route to the segments that actually matter.
TunnelingChisel, ligolo and SSH tunnels to reach internal services from outside the perimeter.
Lateral movementReusing credentials and trust relationships to move sideways without tripping anything.
Linux privescSUID, capabilities, cron, kernel and misconfigured services on the way to root.
Windows privescToken abuse, unquoted paths, service permissions and privilege escalation to SYSTEM.
Password attacksSpraying, targeted cracking and credential reuse, quietly and within lockout policy.
And moreSNMP and NFS, LDAP and MSSQL, printer and IoT footholds, VPN and RDP exposure, port forwarding through jump hosts.
Nmap and RustScanFull TCP and UDP sweeps, version fingerprinting, then scripted follow-up on anything that answers.
Subdomain enumerationPassive and active discovery to widen the surface before touching the primary app.
Content discoveryDirectory and parameter fuzzing with curated plus target-specific wordlists.
Vhost fuzzingHost-header fuzzing to surface virtual hosts that never appear in public DNS.
DNS enumerationRecord sweeps and AD-linked SRV entries to map domain layout before authenticating.
OSINTLeaked credentials, public repos, staff, tech stack and forgotten infrastructure.
Service fingerprintingBanner and behaviour analysis to pin the exact build before picking an exploit path.
User and email enumerationBuilding the valid-account list before a single password is ever tried.
And moreCertificate transparency, ASN and IP-range mapping, cloud-storage discovery, JS-bundle mining for hidden endpoints.
Credential dumpingLSASS, SAM, DPAPI and the credential material that unlocks the rest of the estate.
PersistenceDemonstrating durable access the way an actual intruder would keep it.
Impact demonstrationProving what the compromise is worth in business terms, not in CVSS points.
Exfiltration simulationControlled, scoped exfiltration to show the data path really is open.
Artifact cleanupTracking every artifact dropped and handing back a clean environment.
ReportingReproducible steps, evidence and remediation a defender can act on the same week.
Evidence captureScreenshots, command logs and timestamps captured while the work happens, not after.
Scope disciplineKnowing exactly where the engagement stops, and actually stopping there.
And moreLog review for what a defender would have seen, detection notes, retest cycles, remediation walkthroughs with the dev team.
PythonPrimary language for scanners, exploit PoCs and anything that has to run fast and async.
BashGlue for engagement workflow: enumeration pipelines and repeatable loot handling.
PowerShellLiving off the land on Windows estates without dropping foreign binaries.
Exploit PoCsWriting the proof of concept when the public exploit is broken, loud or nonexistent.
AutomationAutomating the boring 80% so the interesting 20% gets the full attention span.
Burp SuiteThe daily driver for anything that speaks HTTP.
ImpacketThe AD toolkit that handles the protocol work so the thinking stays on the attack path.
Wordlist craftingTarget-derived wordlists that beat a generic ten-million-line dump every time.
And moreFfuf and feroxbuster, netexec, sqlmap where it earns its place, Nuclei templates, Ghidra for the occasional binary.
1

Recon

Map the whole attack surface before touching anything. The finding that matters is usually on the host nobody remembered was in scope.

2

Exploitation

Verify by hand, then chain. Individually low-severity issues become the interesting part once they stack.

3

Post-exploitation

Escalate, pivot and demonstrate impact, because "we got a shell" is not a risk statement anyone can act on.

4

Reporting

Reproducible steps, evidence, real business impact and remediation that fits how the team actually ships.

PortHunt

Open-source tool, Python

A high-speed asynchronous port scanner with built-in CVE lookup and JSON or HTML reporting. Built because I wanted enumeration output that walks straight into a report instead of needing twenty minutes of reformatting first.

  • python
  • asyncio
  • cve lookup
  • json / html
View PortHunt All repositories
porthunt 10.10.11.42
ctxzero@ctx0:~$ porthunt --target 10.10.11.42 --top 1000 --cve --report html

[*] target      10.10.11.42
[*] range       top-1000, 512 workers, 1.5s timeout
[*] started     14:02:11 UTC

[+]   22/tcp   open   ssh        OpenSSH 8.9p1 Ubuntu 3
[+]   80/tcp   open   http       nginx 1.18.0
[+]  445/tcp   open   smb        Samba 4.15.13
[+] 3306/tcp   open   mysql      MySQL 8.0.32

[!] CVE-2023-0286   high   X.400 address type confusion
[!] CVE-2022-38023  crit   Netlogon RPC signing downgrade

[ok] 4 open, 2 cve, 8.42s  ->  porthunt-10.10.11.42.html
ctxzero@ctx0:~$

Writeups

Hack The Box machines, recon to root with every wrong turn included. Pulled live from the writeups repo and readable right here.

Loading from GitHub

v1olet

I'm co-captain of v1olet, an independent offensive security research team. I run the roster, pick the events, decide how we split the board, and play every competition myself.

2nd
BrunnerCTFWeb, pwn, reversing, crypto, forensics
1,103 teams
Top 0.2%
2nd
0xVoid CTFWeb, pwn, reversing, crypto, forensics
500 teams
Top 0.4%
3rd
BroncoCTFOur first event as a team
1,065 teams
Top 0.3%
28th
HTB Cyber ApocalypseThe largest field we've entered
7,000+ teams
Top 0.4%
Bars show field size on a log scaleFull record on CTFtime

Credentials

Hands-on exams graded on both the hacking and the report. Each one is independently verifiable.

CPTS badge from Hack The Box

Certified Penetration Testing Specialist

Hack The Box, CPTS

A ten-day, fully hands-on exam: blackbox web, external and internal penetration testing against a real Active Directory network over VPN. It starts with a letter of engagement and ends with a commercial-grade report, so it grades the communication of findings as much as the testing.

VerifiedView on Credly
CWES badge from Hack The Box

Certified Web Exploitation Specialist

Hack The Box, CWES

A live web application target: find the entry point, chain the findings into real impact and document it professionally, covering APIs and GraphQL alongside classic injection and access control. Issued as CBBH until October 2025.

VerifiedView on Credly
eJPT badge

eJPT

INE Security
Verify
ArcX Cyber Threat Intelligence badge

Cyber Threat Intelligence

ArcX, CTI101

LLM Security Expert

Red Team Leaders, CLLMSE

Got something worth breaking?

Engagements, collaboration, research, or a CTF roster that needs another pair of hands. I usually reply within a day.

LinkedInLuis Schlegel GitHub@ctxzero Hack The BoxProfile TryHackMectxzero CTFtimev1olet