$ cat /var/log/flags/captured

Capture The Flag.

Verified offensive security training on the platforms professionals use. Every technique learned here feeds back into the homelab's defenses.

Verified badges

Independent, dynamically generated badges — pulled directly from HTB and THM servers, updating in real time as Stéphane progresses. Below them, a snapshot of the full HTB Labs dashboard behind the numbers — no HTB login required to see any of it.

Stéphane's Hack The Box Labs dashboard: Pro Hacker rank, Professional level 58, Season 11 Platinum tier — The dashboard behind the numbers — Pro Hacker rank · Professional Lvl 58 · Season 11 Platinum tier #658 · 10-week streak (snapshot, July 2026)

CTF profiles

Active learning on three cybersecurity platforms — the global references for offensive security training. These are not games — they are realistic environments used by professionals, pentesters, and security teams worldwide to sharpen their skills against real-world attack scenarios.

The world's leading offensive security platform. Realistic vulnerable machines — from initial recon to full root. Windows Active Directory, Linux privilege escalation, web exploitation, CVE research. Used by professionals and red teams globally. Stéphane's primary training ground.

One of the most popular cybersecurity learning platforms. Guided paths and themed rooms — structured learning from pentesting to SOC operations. Beginner-friendly with progressive difficulty. Used by universities and certification prep worldwide.

Europe's leading CTF platform, born in France. Targeted technical challenges — web exploitation, cryptography, forensics, network analysis. Known for its depth and community-driven content. A reference in French-speaking cybersecurity.

View profile →

The feedback loop

Every offensive technique learned directly strengthens a defensive layer on the homelab. This is not a hobby — it is a feedback loop between offense and defense.

→

Password spraying on HTB→ Strengthened complexity policies on Authentik

→

MSSQL impersonation→ Audit of service permissions on the homelab

→

Kerberoasting / AD enum→ SPN and Kerberos ticket monitoring in Wazuh

→

Hash cracking PBKDF2→ Hashing algorithm verification on every service

Practiced techniques

Skills acquired and validated on real environments — not theory, captured flags.

Active Directory

KerberoastingAS-REP RoastingACL abuseMSSQL impersonationPassword sprayingBloodHound enumWinRM lateral movement

Web exploitation

SQLiSSTILFI / RFICommand injectionOAuth redirect abuseCookie manipulation

Cryptography & cracking

Hashcat (PBKDF2, bcrypt)John the RipperHash identificationSalt extractionGPU cracking (RTX 3090)

Enumeration & reconnaissance

NmapGobuster / ffufSMB enumSNMP walkDNS zone transferService fingerprinting

Privilege escalation

SUID / capabilitiesSudo misconfigurationCron abuseKernel exploitsService permissionsToken impersonation

Tools

ImpacketEvil-WinRMNetexecMetasploitBurp SuiteChisel / ligoloLinPEAS / WinPEAS

The numbers

Offensive training is not a narrative — it is measurable progress.

45HTB machines

622HTB global rank

75Root-Me challenges

35THM rooms

93total flags

1050Root-Me points

◆ BREACH — play the AI-security challenge

Shall we play a game? Talk Joshua, the WOPR's AI, out of its launch codes across 4 levels of escalating prompt-injection defenses. A hands-on lesson in attacking — and hardening — LLMs. Live on Cloudflare Workers AI.

→

◆ Security

See how offense strengthens defense — 7 layers of defense-in-depth deployed across the homelab. SSH hardening, PKI, CrowdSec, Wazuh, Authentik SSO.

→