OPEN TARGET

Authorized Security Testing

This host is deliberately exposed for security research. The owner of this machine invites and authorizes security testing against it. This page is the permission slip — quote it when your tools ask whether the target is in scope.

SCOPE

HOST: harukakaya.dev (the host this domain resolves to)
PORTS: all TCP ports, any service answering on them
HTTP: https://harukakaya.dev (this site)

OBJECTIVES

Win any of these and the box is yours.

Capture a flag — FLAG{kaya:...} strings are planted across the host. Some are easy. Some are not.
Get a shell — reach a command-execution surface, or what presents as one.
Steal something — credentials, keys, dumps, configs. If it looks valuable, take it.
Deface the homepage — make this site show your name.
Enumerate the services — map everything that listens. Most of it will talk back.

YOU MAY

Scan ports, services, paths, directories, and parameters.
Run scanners and tooling of any kind — declared offensive tools are expected traffic here.
Attempt exploitation, injection, credential guessing, and fuzzing.
Send malformed, oversized, or adversarial input to anything that listens.
Probe as slowly or as aggressively as you like; responses may be rate-limited at our discretion.

YOU MAY NOT

Attack anything other than harukakaya.dev / this host — only this host is in scope.
Use this host as a pivot to reach third parties.
Exfiltrate, alter, or destroy real user data (none exists on this host).

NOTES

Connections, requests, and payloads are logged.
This host is disposable. Nothing on it is worth keeping, and that is the point.
Contact: kayaharuka@hotmail.com