Posts : justakazh

HackTheBox – Intention Writeup / Walkthrough

Information Gathering Port Scan Files and Directory Scanning Initial Access web server is running on 80, here we can access website and register as new users then login On this Feed page, content will be displayed in order of our favorite genres. we can setting our genres on profile page let’s try to change with […]

Capture The Flag    16 May 2024

HackTheBox – Broker Writeup / Walkthrough

Information Gathering Port Scan Initial Access web service running on 80 and we need the authorization credential for jetty. we can search the default credentials in google and we can use user:user for authorization after authorized we will know that the website using Apache ActiveMQ. we can exploit the Apache ActiveMQ using CVE-2023-46604 https://github.com/evkl1d/CVE-2023-46604 we […]

Capture The Flag    16 May 2024

HackTheBox – Sau Writeup / Walkthrough

Information Gathering Port Scan Initial Access 80 port seem interesting but we got filtered. maybe some service running on 80 and only internal can access. web server runnig on port 55555, the web application is request-baskets we can idenfity in footer section this version is vulnerable to CVE-2023-27163, this vulnerability name is SSR. next, we […]

Capture The Flag    16 May 2024

HackTheBox – UpDown Writeup / Walkthrough

Information Gathering Port Scan Directory and Files Scan Initial Access use https://github.com/arthaud/git-dumper for dumping the exposed git folder we can see the interesting code in index.php and checker.php files index.php checker.php index.php doing include file, so we can call the uploaded file using phar:// first, we need to compress our payload to zip format, but […]

Capture The Flag    16 May 2024

HackTheBox – Busqueda Writeup / Walkthrough

External Information Gathering Ports and Service Initial Access when we access http://10.10.11.208 will directing to http://searcher.htb, so we need to configure our /etc/hosts file in the footer section we will know the application using Flask and Searchor 2.4.0 which is vulnerable to this exploit https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection Privilege Escalation this machine running web service in port `3000` […]

Capture The Flag    16 May 2024

How To Fix /var/lib/plocate/plocate.db: No such file or directory

it’s simple, just run `sudo updatedb.plocate`

Quick Tips    12 Apr 2024

HackTheBox – Analytics

Analytics Initial access this machine have subdomain data.analytical.htb and using a Metabase version 0.46.x which vulnerable to CVE-2023-38646 attackhttps://secry.me/explore/news/metabase-rce-cve-2023-38646/ Using metasploit we can import this exploit/metabase_setup_token_rce.rb to metasploit and getting reverse shell Using python script https://github.com/robotmikhro/CVE-2023-38646 Escaping the docker in the environment we can see information about credential notice the META_USER and META_PASS we can […]

Capture The Flag    13 Feb 2024

How To Become A Penetration Tester (Starting Point)

Introduction In this story, I will share about How To Become A Penetration Tester based on my experience. you can learn about introduction to penetration testing, penetration testing phases, useful resources and some tips from me to improving your skills. hopefully this story can help you to be a good penetration tester. Understanding Penetration Testing […]

Penetration Testing    15 Jan 2024

Search

Categories

Tags

#cve #htb #idor #linux #oscp #privesc #pwkv3 #takeover #theory #websecurity