Security Research and Penetration Testing Blog
What is Katana Katana is a fast web crawler made by Project Discovery. The tool is both headless and non-headless with a focus on being used in automation workflows. For example Katana could be used to crawl a target and stored all crawled data, or Katana could be used to crawl a site and store all urls with inputs. The following Katana cheat sheet aims to provide an overview of the tools…
The following Nmap cheat sheet aims to explain what Nmap is, what it does, and how to use it by providing Nmap command examples in a cheat sheet style documentation format. Orignal Published Date: 11th December 2014 What is Nmap? Nmap (network mapper), the god of port scanners used for network discovery and the basis for most security enumeration during the initial stages of a penetration test .…
What is adb? The Android Debug Bridge (adb) is a programming tool used for the debugging of Android-based devices. The daemon on the Android device connects with the server on the host PC over USB or TCP, which connects to the client that is used by the end user over TCP. For hackers, this means we can interact with Android devices to add and remove packages, access debug logs and interact with…
What is httpx? httpx is a fast and multi-purpose HTTP toolkit made by Project Discovery that allows running multiple probes using the retryablehttp library. It is designed to maintain result reliability with an increased number of threads. httpx can be used to obtain web server information, such as headers, download pages and take screenshots of targets. httpx is perfect for validating http/https…
What is SQLMap? SQLMap is a SQL Injection automation tool that is finds and exploits SQL Injection vulnerabilities. SQLMap has a number of functionality that can assist from fingerprinting to fully compromising a database and/or in some cases gaining shell level access to a server. If you do not have a current understanding of the fundamentals of how a SQL injection vulnerability occurs or is…
What is Nikto Nikto Installation Nikto Update Main script is in program Check out the 2.5.0 branch Run using the shebang interpreter Run using perl (if you forget to chmod) Nikto Scan Cheat Sheet Nikto Command Flags Sheet Nikto Example Commands Nikto Scanning Nikto Using a Proxy Nikto2 Features Document Changelog What is Nikto Nikto is an open-source web server scanner that performs comprehensive…
What is Subfinder Install Subfinder Subfinder API Setup Subfinder Config File Subfinder API Sources Example Subfinder API Config File Subfinder Usage Example Subfinder Commands Find Subdomains Single Domain Verify Subfinder Results With HTTPX Subfinder + Naabu Portscan Conclusion Document Changelog What is Subfinder Subfinder is a passive subdomain discovery tool made by Project Discovery. The…
What is Naabu? Naabu vs Nmap What does Naabu do: Download & Install Naabu Naabu Linux Install Kali Naabu Example Command Options Naabu Scan All Ports Naabu Input File, Fast Scan + Verify Port 21 Naabu Fast Scan, Verify, Nmap Services Document Changelog The following Naabu cheat sheet aims to explain what Naabu is, what it does, and how to install it and use it by providing Nabuu command examples…
What is a Reverse Shell Setup Listening Netcat PHP Reverse Shell PHP Reverse Shell One Liner Short One Liner PHP Reverse Shell Base64 PHP Shell MSFVenom PHP Reverse Shell ASP Reverse Shell Bash Reverse Shells MSFVenom Bash Reverse Shell socat Reverse Shell Golang Reverse Shell Netcat Reverse Shell Node.js Reverse Shell Telnet Reverse Shell Perl Reverse Shell Perl Windows Reverse Shell MSFVenom…
What is an Insecure Direct Object Reference (IDOR) Vulnerability? What is a Insecure Direct Object Reference (IDOR) Vulnerability? In the most basic form an IDOR is an object referenced within a web appliation without the correct controls in place to prevent an unauthorised user directly access, either via enumeration or guessing / predicting the object. IDOR vulnerabilties typically occur when…
What is DNS Tunneling You Will Need Buying a Domain How to Change Name Servers On NameSilo DNS Forwarding with Dnscat2 Dnscat2 Port Forwarding What is DNS Tunneling DNS tunneling is used to evade egress firewall rules and/or IDS / proxy or other web filtering applicances by tunneling data over DNS. DNS tunneling usually works as external DNS resolution is available on most networks, it should be…
What is a Lateral Movement SSH Lateral Movement Manually Look for SSH Keys Search For Files Containing SSH Keys Identify The Host for the Key Cracking SSH Passphrase Keys Cracking SSH Passphrase with John the Ripper SSH Passphrase Backdoor SSH Agent Forwarding Hijacking How SSH Agent Works The Risk How To Hijack SSH Agent Forwarding Client Instructions SSH Hijacking with ControlMaster What is a…
Install GenyMotion Setup Burp Proxy with GenyMotion 1. GenyMotion Burp Proxy Settings 2. Android 8.1 Proxy Settings 3. Android Burp Certificate Installation 4. Burp Proxy Settings 5. ADB 6. Installing APK FIles 7. ADB Basic Commands 8. Open GApps This document covers the least exciting aspect of Android mobile app security testing, configuring the testing environment. It is both time consuming and…
Header Poisoning Host: Header Injection Password Reset URL Potential Vulnerable Headers Host Header Password Reset Double Host Header X-Forwarded-Host Header Confirm Vulnerable PoC Password Reset Token Filter Bypass Email Parameter Manipulation Password Change Functions Intercept & Change the Email Password Reset Functons Add Second Email Password Token Referral Header Leak Check List The…
What is SSRF? Identifying Potential Locations for SSRF How to Find SSRF Vulnerabilities SSRF Whitelist Filter Bypass Timing Difference URL Schema / Wrappers PHP SSRF Wrappers / URL Schema ASP.NET SSRF Wrappers / URL Schema Java SSRF Wrappers / URL Schema cURL SSRF Wrappers / URL Schema Open Redirect SSRF Bypass Basic locahost bypass attempts hosts file bypass attempts Enclosed Alphanumeric DNS…
Introduction Penetration Testing Tools Cheat Sheet – a quick-reference, high-level overview for typical penetration testing engagements. This cheat sheet is intended as a concise guide to the common commands used during a penetration test. For more detailed information, I recommend consulting the tool’s manual page (man file), or a more specific penetration testing cheat sheet from the menu on the…
What is an LFI Vulnerability? How to get a Shell from LFI Path Traversal aka Directory Traversal PHP Wrapper expect:// LFI PHP Wrapper php://file PHP Wrapper php://filter /proc/self/environ LFI Method /proc/self/fd/ LFI Method fimap LFI Pen Testing Tool fimap + phpinfo() Exploit What is an LFI Vulnerability? LFI stands for Local File Includes - it’s a file local inclusion vulnerability that allows…
Why use Chromium for Web Application Testing ? Kali Install Chromium Browser Chromium Won’t Launch on Kali Chromium Setup for Web Application Testing Complete Chromium Config Kali Chromium Error: You Are using an Unsupported Command line flag –disable-web-security. Security and Stability will suffer Why use Chromium for Web Application Testing ? The primary reason I use Chromium is for DOM based…
Coffee Difficulty Rating: Challenge Description InsomniHack Smartcat 2 proc/self/environ Injection Reverse Shell Challenge Description Exploit the web based ping command tool and capture the flag. InsomniHack Smartcat 2 Due to filtering it was impossible to enter any white space in commands, making it far more difficult than the smartcat1 challenge. Initially I tried and failed to use a…
Coffee Difficulty Rating: Challenge Description InsomniHack Smartcat1 Flag Challenge Description Exploit the web based ping command tool and capture the flag. InsomniHack Smartcat1 Entering nothing or a ' renders the error: Error running ping -c 1 foo . Enumeration indicated the following characters were filtered $;&|({`\t Note, that included whitespace filtering. I loaded up burp and went through…
Coffee Difficulty Rating: Author Description Port Scanning Service Enumeration HTTP Enumeration PHP Reverse Shell Local Enumeration /home/admin Privilege Escalation Root Flag Author Description A small VM made for a Dutch informal hacker meetup called Fristileaks. Meant to be broken in a few hours without requiring debuggers, reverse engineering, etc.. VMWare Users - MAC Address If you are a…
Coffee Difficulty Rating: Author Description Host Enumeration Port Scanning Service Enumeration Squid Enumeration Nikto scan via Proxy Shellshock Bash Reverse Shell Local Enumeration Local Privilege Escalation Root Flag Author Description This CTF gives a clear analogy how hacking strategies can be performed on a network to compromise it in a safe environment. This vm is very similar to labs I…
Coffee Difficulty Rating: Author Description Enumeration Port Scanning Service Enumeration HTTP Enumeration Hash Cracking MD5 Hashcat Steghide SFTP Login Fatcat FAT16 Forensics Tool SSH Shell Local System Enumeration Account: RogerWaters Account: NickMason Extracting Morse Code Data Morse Code Decoded Discovered Credentials Account: RichardWright PATH Manipulation Account: DavidGilmour Web…
Coffee Difficulty Rating: </i> Description JServ Enumeration JDWP Enumeration Apache Tomcat JServ Proxy setup Apache Tomcat Proxy Setup Script Remote Exploitation Meterpreter Shell Local Privilege Escalation Enumeration Binary Interrogation Bash Function Manipulation Root Flag Description Sleepy is part of the /dev/random: series created by Sagi-, it’s a little more difficult than Pipe depending…
Coffee Difficulty Rating: Description Enumeration Service Enumeration HTTP Enumeration Source Code Interrogation php.js Interrogation log.php.BAK Interrogation Burp Suite - POST Request Burp decode string Injecting Reverse Shell Code PHP Shell Reverse Shell Linux Local Privilege Escalation Tar Unix Wildcards Local Privilege Escalation Unix Wildcards Tar Arbitrary Command Execution Root Flag…
Coffee Difficulty Rating: </i> Author Description SQLMAP SQLMap Enumerate Databases SQLMap Full Command SQLMap Database Dump SQLMap Database Table Enumeration SQLMap Enumerate Columns SQLMap Dump Passwords SQLMap Dump MySQL DB and crack hashes SQLMap hash cracking options MySQL Local Privilege Escalation Root Root Flag Author Description I created this machine to help others learn some basic CTF…
Vim Insert mode & Command Mode Vim Insert Mode Vim Command Mode Vim File Navigvation Move up, down, left and right in Vim Vim Page Down Vim Half a Page Down Vim Page Up Vim Half a Page Up More Advanced Ways of Entering Insert Mode Vim Insert Text at Start of the Line Vim Insert Text at the end of the Line Vim Append text to the right of the Cursor Begin a new line below Vim replace line Vim…
Description: Tested Versions Tested Operating Systems Instructions groovy script wget shell groovy script execute shell command Execute the Groovy Scripts via scriptText Jenkins API Get Shell More info about Jenkins More Resources Description: Jenkins (continuous intergration server) default install allows for unauthenticated access to the API on the Jenkins Master Server (default behavour).…
Coffee Difficulty Rating: Author Description Enumeration Host Service Enumeration Web Application Analysis HTTP Proxy SSH Connection Local Enumeration MySQL Credentials Privilege Escalation - Password Reuse Getting root: Conclusion Author Description This CTF was designed by Telspace Systems for the CTF at the ITWeb Security Summit and BSidesCPT (Cape Town). The aim is to test intermediate to…
Coffee Difficulty Rating: Author Description Port Scanning Service Enumeration HTTP Enumeration Level 1 Level 2 Burp Suite - PHP Shell Injection in an Image file Reverse Shell: Level 3 Flag Author Description Welcome to the ZorZ VM Challenge This machine will probably test your web app skills once again. There are 3 different pages that should be focused on (you will see!) If you solve one or all…
Systemd is now the default in RHEL / CentOS 7, the following post is a cheat sheet for systemd commands, useful for local system enumeration. Systemd is becoming the default on most distros Systemd is becoming the default in many distros, RHEL, CentOS, Ubuntu 15 and it offers a single command to manage your system, instead of switching between chkconfig or running init scripts. Systemd Service…
Coffee Difficulty Rating: Author Description Port Scanning Service Enumeration HTTP Enumeration SQL Injection Wordpress - Reverse PHP Shell Privilege Escalation Post Exploitation Enumeration Author Description The goal of this challenge is to break into the machine via the web and find the secret hidden in a sensitive file. If you can find the secret, send me an email for verification. Port…
Just for fun, here is my list of post install config changes plus list of apps I install after installing Mac OS X ##Side Dock Open: System Preferences > Dock click Left . ##Enable Right Click MacBook Trackpad Open: System Preferences > Trackpad click click in bottom right corner under Secondary Click . ##Enable path view in finder Open Finder View > Show Path Bar The path will render at the…
Coffee Difficulty Rating: Description Enumeration Host Service Enumeration Web Application Analysis Pcap Analysis Local System Enumeration Local Privilege Escalation Root Flag Conclusion Description A VulnHub VM challenge, based on packet analysis and port knocking. Author Note: I got the word “Fart Knocker” from watching beavis and butthead back in the day. Otherwise you kids might not understand…
nbtscan is a command line tool that finds exposed NETBIOS nameservers, it’s a good first step for finding open shares. Don't use the version of nbtscan that ships with KALI Grab nbtscan from the above link and build it from source, this version tends to find more information Compile nbtscan on KALI root@kali:~/nbtscan# wget http://www.unixwiz.net/tools/nbtscan-source-1.0.35.tgz…
What is enum4linux enum4linux is an alternative to enum.exe on Windows, enum4linux is used by penetration testers to enumerate Windows and Samba hosts. enum4linux provides the following functionality: RID cycling (When RestrictAnonymous is set to 1 on Windows 2000) User listing (When RestrictAnonymous is set to 0 on Windows 2000) Listing of group membership information Share enumeration Detecting…
Linux Local Enumeration Script Demo Script Code Wget URL I’ve made my Linux Local Enumeration Script available below, it’s far from perfect and I could spend forever improving it. But, it has saved me a bunch of time and it works great for a first pass, after that post shell excitment :) You might also be interested in this list of Linux commands for post exploit / local privilege enumeration.…
Security Harden CentOS 7 Based on a Minimal Install Issues with Security Hardening Why use OpenSCAP ? Kickstart Secure Partition Mount Options Install NTP Configure System for AIDE Install AIDE Prevent Users Mounting USB Storage Enable Secure (high quality) Password Policy Secure /etc/login.defs Pasword Policy Set Last Logon/Access Notification Max Password Login Attempts per Session Set Deny For…
What is Pivoting ? SSH Pivoting Cheatsheet SSH Port Forwarding SSH Port Forwarding with Proxychains Using Proxychain port forwards Configure Metasploit to use a SSH Pivot Don’t use 127.0.0.1 with Metasploit Meterpreter Pivoting Cheatsheet Pivoting Example Diagrams Starting Point Routing Traffic to the Same Subnet SSH Pivoting using Proxychains SSH Port Forwarding Command SSH and Meterpreter…
Coffee Difficulty Rating: Description Enumeration Port Scanning Service Enumeration HTTP Enumeration Shellshock Identify Current User Shellshock home dir perms Shellshock files owned by user bynarr Shellshock mail spool readable Reverse Shell Local Enumeration Shellshock Local Privilege Escalation Root Flag Description Sokar was a vulnhub competition, unfortunately I did not have enough free time…
Coffee Difficulty Rating: Description SSH Shellshock I rooted Tr0ll 1, so thought it would be rude not to try the second VM in the Tr0ll series… Tr0ll 2 requires a buffer overflow to perform local escalation, the first VM didn’t require any exploitation. However, like the first VM I’d say this is challenege is more a case of guessing credentials, trying things you think probably wont work.…
Coffee Difficulty Rating: Remote Exploit Local Enumeration Weak Filesystem Permissions Enumeration Findings Local Privilege Escalation Got Root I thought I’d have a go at a Boot2Root over Christmas, looking through the VM’s I came accross Tr0ll: 1 the description caught my attention: Tr0ll was inspired by the constant trolling of the machines within the OSCP labs. The goal is simple, gain root and…
Linux Penetration Testing Commands Linux Network Commands System Information Commands Redhat / CentOS / RPM Based Distros YUM Commands Debian / Ubuntu / .deb Based Distros Linux User Management Linux Decompression Commands Linux Compression Commands Linux File Commands Samba Commands Breaking Out of Limited Shells Misc Commands Linux File System Permissions Linux File System Linux Interesting…
Coffee Difficulty Rating: Author Description Host Enumeration Port Scanning Service Enumeration Website Inspection Burp Suite - Send Reverse Shellshock Reverse Shell Author Description This course details the exploitation of the vulnerability CVE-2014-6271 AKA Shellshock . This vulnerability impacts the Bourne Again Shell “Bash”. Bash is not usually available through a web application but can be…
Coffee Difficulty Rating: Author Description Enumeration Host Service Enumeration Inspection of the Web Application XSS Session ID Hijacking XSS Comment HTTP Server Email Barbara (victim) Swapped Session ID Burp Suite Reverse Shell Drupal settings.php Hashcat MD5 cracking Hydra SSH Brute Force SSH Account Compromise Local Privilege Escalation Author Description The LAMPSecurity project is an…
Coffee Difficulty Rating: Author Description Service Enumeration Web Application Interrogation Non Privileged Shell Local Privilege Escalation Author Description The object of the game is to acquire root access via any means possible (except actually hacking the VM server or player). The purpose of these games are to learn the basic tools and techniques in vulnerability assessment and…
Coffee Difficulty Rating: Author Description Enumeration Host Service Enumeration Web Application Enumeration Web Application on Port 8080 PHP Shell Upload Dirbuster Reverse Shell Local Enumeration MySQL Hashcat md5 cracking Cracked MD5 Hashes Local Privilege Escalation Author Description The LAMPSecurity project is an effort to produce training and benchmarking tools that can be used to educate…
Coffee Difficulty Rating: Author Description Enumeration Host Service Enumeration Web Application Enumeration SQLMap - SQL Injection Web Application Exploitation Local Privilege Escalation Author Description The LAMPSecurity project is an effort to produce training and benchmarking tools that can be used to educate information security professionals and test products. Author: madirish2600…
Coffee Difficulty Rating: Author Description Enumeration Host Service Enumeration HTTP Enumeration Forced Browsing Web Application Enumeration Hash Disclosure Verified Hash Type Hashcat md5 cracking Web Application Exploitation Linux Local Enumeration Local Privilege Escalation Author Description The LAMPSecurity project is an effort to produce training and benchmarking tools that can be used to…
Coffee Difficulty Rating: Author Description Enumeration Port Scanning Service Enumeration HTTP Enumeration LFI Exploit SQLMap Enumeration SQLMap SQLMap Dump Hahes + Crack hashes SSH Login Linux Local Privilege Escalation Post Exploitation Enumeration Author Description The LAMPSecurity project is an effort to produce training and benchmarking tools that can be used to educate information security…