💡 Check the about page
reverse_ssh guide for plebs
https://github.com/NHAS/reverse_ssh/blob/main/README.md New to this tool but the more I use it the more I like it. This basic guide will get you started for oscp tunneling. docker run -d --name rssh …
SugarVale
We have found a JSON web token(JWT) After trying to manipulate this token for a day I realised there was something wrong with the Caido add-on. To do this I needed a python tool called jwt_tool: …
Laser
X.X.X.172 Eric.Wallows EricLikesRunning800 DC01 laser.com X.X.X.173 MS01 X.X.X.174 MS02 Bloodhound: bloodhound-python -u “Eric.Wallows” -p ‘EricLikesRunning800’ -d laser.com -c …
Secura
X.X.X.95 Use the credentials given to evil-winrm into the x.x.x.95 machine. Eric.Wallows EricLikesRunning800 evil-winrm -i 192.168.177.95 -u Eric.Wallows -p EricLikesRunning800 Upload winpeas: …
Pelican
You may be in a tough time but that setback is simply a setup for a greater comeback. – Joel Osteen nmap 192.168.209.98 -p- -sC -sV -sS --min-rate 5000 Nothing really… Enum4linux: Also …
Wombo
http: 80 DNS? 53 nodedb: 8080 Redis: 6379 MongoDB: 27017 This should have been easy but because I’m hung over I forgot everything. Grab the Exploit and module and try the exploit, if it …
Detection
https://nvd.nist.gov/vuln/detail/CVE-2024-32651 https://github.com/s0ck3t-s3c/CVE-2024-32651-changedetection-RCE python -m venv .venv source .venv/bin/activate pip install requests beautifulsoup4 git …
Hub
Don’t log in. If you create a user just revert the lab. https://github.com/SanjinDedic/FuguHub-8.4-Authenticated-RCE-CVE-2024-27697 git clone …
Cobweb
“That was pretty tough” Me nmap 192.168.154.162 -p- -sC -sV -sS --min-rate 5000 FTP: The recovered PHP script has a eval vulnerability, and has the ability to use the url for SQL …
CVE-2025-10952
nmap 192.168.159.84 -p- -sC -sV -sS --min-rate 5000 https://nvd.nist.gov/vuln/detail/CVE-2025-10952 https://github.com/geyang/ml-logger/issues/74 This took a few go’s to get the correct syntax. …
Develop
“Austria! Well then… G’day mate!” — Dumb and Dumber nmap 192.168.182.135 -p- -Pn --min-rate 5000 gobuster dir -u http://192.168.182.135 -w /usr/share/wordlists/dirb/common.txt Gitdumper: …
Cobbles
“There are so many different kinds of stupidity, and cleverness is one of the worst.” ― Thomas Mann nmap 192.168.182.214 -p- -sS -sC -sV –min-rate 5000 server-status …
Peppo
“I have problems with turns, because I’m left-handed, and they haven’t built a left-handed runway yet.” – Derek Zoolander nmap 192.168.144.60 -p- -sS -sC -sV –min-rate 5000 whatweb …
Tico
“Life is hard. After all, it kills you.” – Katharine Hepburn nmap 192.168.216.143 -p- -sS -sC -sV --min-rate 5000 Lets look a ftp first: Admin password maybe? Right click and follow conversation > …
Hetemit
Change the header to a POST request and add: Content-Type: application/x-www-form-urlencoded Python code can be executed once the header have been manipulated… POST /verify HTTP/1.1 Host: …
Nibbles
“Fortune sides with him who dares.” ― Virgil Full port scan reveals a PostgreSQL port: Once we’re authenticated we can try this… This is a rabbit hole, cost me hours….. There is a …
Mantis
You’re unstoppable as long as you keep taking the next step. — Beverly K. Bachel curl http://192.168.214.204/ | grep team-title | awk -F '[><]' '{print $3}' > users.txt Patric Green …
Marshalled
“The best cheater always wins” ― Eli Kennedy sudo vim /etc/hosts Lol, monitoring wasn’t in my wordlist. From now on I’ll use seclist/../DNS…. wfuzz -u …
CVE-2025-50817
No quote this time, who has the time. nmap 192.168.148.197 -p- -sV -sS -sC --min-rate 5000 feroxbuster -u http://192.168.148.197:5000/ -w /usr/share/wordlists/dirb/big.txt -t 100 gobuster dir -u …
Bunyip
Disappointment is a sort of bankruptcy - the bankruptcy of a soul that expends too much in hope and expectation.” ― Eric Hoffer nmap -p- -sS -sC -sV 192.168.166.153 –min-rate 5000 Hash extension …
Escape
“How did I escape? With difficulty. How did I plan this moment? With pleasure.” ― Alexandre Dumas nmap -p- 192.168.162.113 –min-rate 5000 Use Caido to upload a reverse shell file, changing the …
Deployer
“Some days, I feel like my frustration has its own personality.” – Ellie Reed ftp anonymous@192.168.235.158 password:deployer Update your hosts file: sudo vim /etc/hosts FTP: All the files …
Injecto
“The problem with people who have no vices is that generally you can be pretty sure they’re going to have some pretty annoying virtues” ― Elizabeth Taylor nmap -p- 192.168.153.173 …
Flower
There is no patch for stupidity. ― Kevin Mitnick Gobuster: gobuster dir -u http://flower.pg -w /usr/share/wordlists/dirb/common.txt Nothing… ffuf -u http://FUZZ.flower.pg -w …
Thor
There can be no greater gift than that of giving one’s time and energy to help others without expecting anything in return. ― Nelson Mandela https://webmin.com/ https://openlitespeed.org/ Brute force: …
Blackgate
Just because we have the best hammer does not mean that every problem is a nail. -Barack Obama This one has a deep rabbit hole to fall into regarding Return Orientated Programming. … Port: 6379 …
Debugging on Arm
https://wiki.archlinux.org/title/Main_page I was really struggling with this, it started when I was trying to find windows binary buffer-overflow vulnerabilities. When reading through guides and …
Glider
The rain will stop, the night will end, the hurt will fade. Hope is never so lost that it can’t be found. Ernest Hemingway nmap 192.168.183.226 -p- -sS -sC -sV -A --min-rate 5000 Start caido or …
Clue
“It’s not what happens to you, but how you react to it that matters.” – Epictetus Looking for bites…. http always first…. https://github.com/avalanche123/cassandra-web …
Emporium
“Nothing in this world can take the place of persistence. Talent will not; nothing is more common than unsuccessful men with talent.” - Calvin Coolidge. curl …
BadCorp
I had to look this up in another guide, I was close. It was obvious that the usernames and passwords were here but in what format. For the usernames I should have been trying: justinh justin.hammer …
Nickel
“Mistakes are the usual bridge between inexperience and wisdom.” – Phyllis Theroux This was an fun lab, I need more practice with setting up and using logolo tunnels :) nmap …
Vector
“Would it save you a lot of time if I just gave up and went mad now?” ― Douglas Adams This lab forced me back to the start, learning something I’d never heard of and it took a good few hours to …
Zipper
“The soul becomes dyed with the colour of its thoughts.” ― Marcus Aurelius The http site seems to compress files for you. Create a php reverse shell and upload it to the site: To see the source code …
Heist
“All things change in a dynamic environment. Your effort to remain what you are is what limits you.” -Puppet Master This guide is to help trigger your mind. Train your brain to look sideways for …
Craft
“For what level of mediocrity will you settle?” –Brandon Lee Create a document.odt in Libre. Navigate to: Tools > Macros > Organise Macros > Basic Create a new macro and …
Craft2
“Don’t try to be like Jackie. There is only one Jackie. Study computers instead.” – Jackie Chan Lets begin: While waiting for a nmap I tried the IP in a browser. This was …
Vault
“I ate his liver with some fava beans and a nice chianti” – Thomas Harris nmap -p- -sS -sV -sC -A 192.168.175.172 -min-rate 5000 NetBIOS computer name: DC NetBIOS domain name: VAULT …
Resourced
nmap -p- -sV -sC -sS -A 192.168.181.175 -min-rate 5000 > nmap.txt enum4linux-ng -A 192.168.181.175 First creds: V.Ventz:HotelCalifornia194! RESOURCEDC NetBIOS domain name: resourced DNS domain: …
Slort
“Do not judge me by my success, judge me by how many times I fell down and got back up again.” – Nelson Mandela While I’m waiting for nmap, I checked for http pages. The nmap results …
Nagoya
“Indeed, humans are the least reliable in this world.” — Sōseki Natsume While I wait for a scan I have a quick look to see if there is a http website. This look likes likely usernames. nmap -p- …
Nara
It may seem difficult at first, but everything is difficult at first. Miyamoto Musashi nmap -p- 192.168.177.30 -min-rate 5000 enum4linux-ng -A 192.168.126.30 smbclient -N -L //192.168.126.30/ kerbrute …
Sams
nmap -p- 192.168.168.248 –min-rate 5000 nmap -p- 192.168.168.248 -sS -sC -sV -A –min-rate 5000 enum4linux-ng -A 192.168.168.248 gobuster dir -u http://192.168.168.248/ -w …
Kyoto
“Humans have both the urge to create and destroy. Hayao Miyazaki nmap -sS -sC -sV -p- 192.168.119.31 --min-rate 500 enum4linux-ng 192.168.119.31 SMB NetBIOS computer name: KYOTO NetBIOS domain …
Hokkaido
“Before you react, think. Before you spend, earn. Before you criticise, wait. Before you quit, try.” Ernest Hemingway If you find usernames, especially if they are words, repeat them as …
SMB
Simple Message Block (SMB) is a protocol for accessing/sharing files and communications between devices and systems on a network. On windows it can authenticate via the Kerberos and NTLM protocols. …
Access
“there is nothing outside of yourself that can ever enable you to get better, stronger, richer, quicker, or smarter. Everything is within. Everything exists. Seek nothing outside of yourself.” …
Jacko
nmap -p- $IP –min-rate 5000 -o nmap-deep.txt gobuster dir -u http://$IP/ -w /usr/share/wordlists/dirb/common.txt Lets have a look at the site on port 80. Port 8082: Default password will get you …
Osaka
nmap -p- 192.168.116.20 –min-rate 5000 -o nmap.txt` ftp anonymous@192.168.116.20 password:osaka This ftp.exe binary will need to be examined with ghidra. I had to find a guide for this: …
Algernon
nmap -A You can use metasploit for this but obviously its better not to. searchsploit smarter searchsploit smarter Even though the site is on port 9998 you need the leave the port as 17001 but change …