End-users constantly make GET or POST request to the internet to retrieve information. The most common protocol used here is HTTP/S. But this communication is not just about making requests. It needs to be meaningful when sent from client to server or vice-versa. Here’s when HTTP header comes in. With headers, client/server can send additional information with HTTP request. In this blog…
Deploy django web applications for free on pythonanywhere. Also solve the hassle of storing static files.
Hey there! This is Shreya and today I am gonna show you how to pwn buff from hackthebox. Buff is an easy level windows machine having a straightforward way to obtain initial foothold. Privilege escalation to Administrator requires to abuse a service that has its exploit available on exploit-db, still its tricky to get through. With that being said, let's get started.…
Most often people plan a trip to Goa for its beaches, the exotic cashew wine, the breathtaking sceneries and the elegant casinos. But for me, the reason was quite different. Its Nullcon. It was their 10th anniversary, after missing so many years of exclusive seminars and a bunch of elite sessions at a prime venue, I finally got my first chance to…
Hey fellas!! Its time for remote from hackthebox. This was an easy Windows machine. The initial foothold for the machine was based on CVE of a CMS and has a straight-forward privilege escalation to Administrator.With all that said, let’s get started!! Scan the host for the open ports and services. # nmap -sC -sV -oA remote.nmap 10.10.10.180 The output revealed 3 interesting…
Aragog is a medium level linux machine from hackthebox. Initial foothold is based on exploiting XXE and the privilege escalation requires to log the password by creating a backdoor.
The linux penetration checklist is a list of points that you should always look into while pentesting into any linux box. It has points from initial foothold to privilege escalation
Crack tcs digital interview with a few tips and tricks. Know where to focus, what to improve, what to learn.
Querier is a medium level windows machine. It exploits the mssql-server running on the box. The privilege escalation to administrator exploits GPP xml files
When a normal user is part of lxd group, he can easily escalate his privileges to root..security.privilege= true creates a privileged lxd container.
Hey pentesters! In this post blog post, I am gonna walk you through canape that is a medium linux machine from hackthebox. Summary The initial foothold on the box is based on python pickle injection that leads to remote code execution. Privilege escalation to user exploits a vulnerability in couchdb that can be leveraged to create a dummy user with _admin role.…
Hi! This is Shreya Pohekar. And Today, its time for Admirer from hackthebox. So it was an "easy" rated machine, still, it needed a vigilant eye to make it through. Summary The initial foothold on the box required a lot of enumeration. The creators of the box really wanted to take a note of every detail. Getting the user required to have…
The internet is on a boom. Enterprises being small or large, and individuals have completely moved over to the virtual world. I get so intimidated by the fact that one just need a laptop and internet and you possess the power to transform the generations!! Internet provided us with endless capabilities but the greater the presence, greater is the security risk!! Why…
We generate enormous amount of data everyday working with virtual machines. Several file are so important that one cant afford to loose them. But what if, oneday you realize that you virtual machine has crashed due to some reason and all your data is gone forever. Seems like a nightmare that no-one wanna encounter. Most of us take file backup on github,…
Hey all! In this blog post, we’ll be walking through blunder from hackthebox. Blunder is an easy level linux machine. Summary The initial foothold on the box requires a bit of enumeration to find out the correct user who can login into CMS:- bludit. There is the file upload vulnerability on the cms that gets the initial shell on the box.…