🐾 HTB: Cat

Git repo leak → Stored XSS cookie theft → SQLite SQLi → Apache logs → Gitea XSS for privesc

Writeup is private while the box is still active. Full version will be published upon retirement.