A security researchers' thoughts on cybersecurity education, training, AND hacking ALL THE THINGS: web, mobile, cloud, etc.
Another day, another challenge.
I’m restarting the series #PwnItFriday where I hack machines from hackthebox and TryHackMe.
Without further ado, the machine I’m solving today is Tactics.
Topics explored in this machine are network protocols, SMB, reconnaissance, and misconfigurations.
Click the video to learn how to solve this machine!
Like the content — support by Buying a Coffee
Another day, another challenge.
I’m restarting the series #PwnItFriday where I hack machines from hackthebox and TryHackMe.
Without further ado, the machine I’m solving today is Pennyworth.
Topics explored in this machine are web servers, Jenkins, Java, reconnaissance, remote code execution, and default credentials.
Click the video to learn how to solve this machine!
Like the content — support by Buying a Coffee
Another day, another challenge.
I’m restarting the series #PwnItFriday where I hack machines from hackthebox and TryHackMe.
Without further ado, the machine I’m solving today is Ignition.
Topics explored in this machine are web servers, common applications, Magento, reconnaissance, and weak credentials.
Click the video to learn how to solve this machine!
Like the content — support by Buying a Coffee
Another day, another challenge.
I’m restarting the series #PwnItFriday where I hack machines from hackthebox and TryHackMe.
Without further ado, the machine I’m solving today is Preignition.
Topics explored in this machine are connecting to a web server, custom applications, reconnaissance, web site structure directories, and default credentials.
Click the video to learn how to solve this machine!
Like the content — support by Buying a Coffee
Another day, another challenge.
I’m restarting the series #PwnItFriday where I hack machines from hackthebox and TryHackMe.
Without further ado, the machine I’m solving today is Explosion.
Topics explored in this machine are networking, programming, remote desktop protocol (RDP), reconnaissance, and weak credentials.
Click the video to learn how to solve this machine!
Like the content — support by Buying a Coffee
Another day, another challenge.
I’m restarting the series #PwnItFriday where I hack machines from hackthebox and TryHackMe.
Without further ado, the machine I’m solving today is Synced.
Topics explored in this machine are connecting to a Rsync server, networking protocols, reconnaissance, and anonymous/guest access.
Click the video to learn how to solve this machine!
Like the content — support by Buying a Coffee
Another day, another challenge.
I’m restarting the series #PwnItFriday where I hack machines from hackthebox and TryHackMe.
Without further ado, the machine I’m solving today is Mongod.
Topics explored in this machine are connecting to a web servers, databases, reconnaissance, misconfigurations, and anonymous/guest access.
Click the video to learn how to solve this machine!
Like the content — support by Buying a Coffee
Another day, another challenge.
I’m restarting the series #PwnItFriday where I hack machines from hackthebox and TryHackMe.
Without further ado, the machine I’m solving today is Redeemer.
Topics explored in this machine are connecting to a Redis server, vulnerability assessments, database, reconnaissance, and anonymous/guest access.
Click the video to learn how to solve this machine!
Like the content — support by Buying a Coffee
Another day, another challenge…
In this post, we’re starting a new series the Advent of Cyber series that is hosted by TryHackMe. This is the third year of the Advent of Cyber where a challenge is released everyday leading to Christmas. In total there will be 25 challenges. In these challenges, we’re McSkidy an elf trying to save Christmas.
In our fifth challenge, we’re presented with a scenario where the elves express their joy in a forum. Unfortunately for the elves, the Grinch has created an admin an account on the forum and has installed a bad plugin that changes Christmas to Buttmas *GASP*. We can’t have that for the kids and Santa!
The topic explored in this challenge was Cross-Site Scripting (XSS). We learned there are four flavors – Document Object Model (DOM), Reflected, Stored, and Blind, and why XSS is important. XSS in a nutshell is an injection attack where the input is not being validated or sanitized. Meaning the application allows ANY input from the user. This can be *hint, hint* HTML, JavaScript, etc. Of all the different flavors of XSS the most dangerous/catastrophic is Stored XSS. As the name implies it stores the payload into for instance a database. Meaning anyone that visit the website or invokes the particular database will be susceptible to that attack. We will use Stored XSS in this challenge.
Can we use the information we learned about XSS to remove the bad plugin in the forum?
Well… click the below video to find out!
If you enjoy my content, buy me a coffee. Link –> http://buymeacoffee.com/thefluffy007
Another day, another challenge…
In this post, we’re starting a new series the Advent of Cyber series that is hosted by TryHackMe. This is the third year of the Advent of Cyber where a challenge is released everyday leading to Christmas. In total there will be 25 challenges. In these challenges, we’re McSkidy an elf trying to save Christmas.
In our fourth challenge, we’re presented with a scenario where Santa is running behind! We also learned that Santa has been naughty and did not adhere/follow the password requirements. Christmas is in jeopardy, and we need to help Santa get back on track. In this challenge the topics explored are authentication which is used to verify who we are to a system. The most common way to do this is with a username and password, but another technique is to use biometrics which is something that is unique to a person such as their fingerprint and/or retina (eye) scan.
The next topic discussed is fuzzing which is the automated process of finding information. In our case, we’re going to use fuzzing to find Santa’s password to get into the system and view his calendar. With fuzzing, there’s a tool that’s going to be used an interception proxy which intercepts requests before they are sent to the server. Remember the HTTP protocol (which we’re using) relies on requests and responses to communicate.
Can we use the topics above to make sure Santa stays on schedule and deliver the presents on time?
Well… click the below video to find out!
P.S. We also need to have a serious talk with Santa on following the password requirements in the future, so this doesn’t happen again!
If you enjoy my content, buy me a coffee. Link –> http://buymeacoffee.com/thefluffy007
You must be logged in to post a comment.