neetech18

five86: 1 Walkthrough Netdiscover- Nmap- Running OpenNetAdmin Service on Port 80- Found Command Injection Exploit of Exploit-DB- https://www.exploit-db.com/download/47772 Downloaded the file using wget and changed the file name to .rb file. Next copied to Metasploit exploits directory as- cp 47772.rb /usr/share/metasploit-framework/modules/exploits/ Using msfconsole with the above module as- Setting up LHOST and RHOST- Running the Exploit-(Found Low Privilege shell)- Enumerating the Directory- Accessing .htpasswd file- Found Douglas hash in the .htpasswd file- So, I found that the password is a 10-character “aefhrt” string, so you’ll need to prepare a 10-character long password dictionary. Here we use crunch to create the dictionary and execute the following command to follow the pattern of the password as the author has said. Used Crunch- Usage: crunch <min> <max> [options] Getting Has...

Nmap Scan Script -Vulnerability Scan sudo git clone https://github.com/scipag/vulscan.git kali@kali:/usr/share/nmap/scripts$ sudo chmod +x vulscan/ kali@kali:/usr/share/nmap/scripts/vulscan$ sudo chmod +x * cd .. kali@kali:/usr/share/nmap/scripts$ sudo git clone https://github.com/vulnersCom/nmap-vulners.git kali@kali:/usr/share/nmap/scripts$ cd nmap-vulners/ kali@kali:/usr/share/nmap/scripts/nmap-vulners$ sudo chmod +x * kali@kali:/usr/share/nmap/scripts/nmap-vulners$ nmap --script vulscan,nmap-vulners -sV localhost Thanks!!

This challenge is Inon Shkedy's 31 days API Security Tips -API TIP: 1/31- Older APIs versions tend to be more vulnerable and they lack security mechanisms. Leverage the predictable nature of REST APIs to find old versions. Saw a call to api/v3/login? Check if api/v1/login exists as well. It might be more vulnerable. -API TIP: 2/31- Never assume there’s only one way to authenticate to an API! Modern apps have many API endpoints for AuthN: /api/mobile/login | /api/v3/login | /api/magic_link; etc.. Find and test all of them for AuthN problems. -API TIP:3/31- Remember how SQL Injections used to be extremely common 5-10 years ago, and you could break into almost every company? BOLA (IDOR) is the new epidemic of API security. As a pentester, if you understand how to exploit it, your glory is guaranteed. Learn more about BOLA : https://medium.com/@inonst/a-deep-dive-on-the-most-critical-api-vulnerability-bola-1342224ec3f2 -API TIP: 4/31- Testing a Ruby on Rails App & n...

hackNos: ReconForce Walkthrough Nmap- Nmap scan report for 192.168.56.106 Host is up, received  arp -response (0.0012s latency). Scanned at 2020-02-17 13:51:07 India Standard Time for 26s Not shown: 997 closed ports Reason: 997 resets PORT   STATE SERVICE REASON         VERSION 21/ tcp  open  ftp     syn-ack  ttl  64  vsftpd  2.0.8 or later |_ftp-anon: Anonymous FTP login allowed (FTP code 230) | ftp-syst: |   STAT: | FTP server status: |      Connected to ::ffff:192.168.56.1 |      Logged in as ftp |      TYPE: ASCII |      No session bandwidth limit |      Session timeout in seconds is 300 |      Control connection is plain text ...

Python 2.x $ python -m SimpleHTTPServer 8000 Python 3.x $ python -m http.server 8000 Twisted (Python) $ twistd -n web -p 8000 --path . Or: $ python -c 'from twisted.web.server import Site; from twisted.web.static import File; from twisted.internet import reactor; reactor.listenTCP(8000, Site(File("."))); reactor.run()' Depends on Twisted. Ruby $ ruby -rwebrick -e'WEBrick::HTTPServer.new(:Port => 8000, :DocumentRoot => Dir.pwd).start' Credit: Barking Iguana Ruby 1.9.2+ $ ruby -run -ehttpd . -p8000 Credit: nobu adsf (Ruby) $ gem install adsf   # install dependency $ adsf -p 8000 Credit: twome No directory listings. Sinatra (Ruby) $ gem install sinatra   # install dependency $ ruby -rsinatra -e'set :public_folder, "."; set :port, 8000' No directory listings. Perl $ cpan HTTP::Server::Brick   # install dependency $ perl -MHTTP::Server::Brick -e '$s=HTTP::Server::Brick->new(port=>8000); $s->mo...

CTF Labs HackTheBox https://www.hackthebox.eu Vulnhub https://www.vulnhub.com Practical Pentest Labs https://practicalpentestlabs.com Labs Wizard Security https://labs.wizard-security.net Pentestlab https://pentesterlab.com/ Hackthis https://www.hackthis.co.uk Shellter https://shellterlabs.com/pt/ Root-Me https://www.root-me.org/ Zenk-Security https://www.zenk-security.com/epreuves.php W3Challs https://w3challs.com/ NewbieContest https://www.newbiecontest.org/ The Cryptopals Crypto Challenges https://cryptopals.com/ Penetration Testing Practice Labs http://www.amanhardikar.com/mindmaps/Practice.html alert(1) to win https://alf.nu/alert1 Hacksplaining https://www.hacksplaining.com/exercises Hacker101 https://ctf.hacker101.com Academy Hackaflag https://academy.hackaflag.com.br/ PentestIT LAB https://lab.pentestit.ru Hacker Security https://capturetheflag.com.br/ PicoCTF https://picoctf.com Explotation Education https://expl...

Initial Setup & Workspaces The first thing we need to do, if it is not done already, is start the PostgreSQL service that Metasploit's  database  uses, with the  systemctl start postgresql  command. systemctl start postgresql At any time, we can use the  status  keyword to check the current state of the service. systemctl status postgresql ● postgresql.service - PostgreSQL RDBMS Loaded: loaded (/lib/systemd/system/postgresql.service; disabled; vendor preset: disabled) Active: active (exited) since Tue 2019-01-15 09:11:42 CST; 1min 6s ago Process: 1708 ExecStart=/bin/true (code=exited, status=0/SUCCESS) Main PID: 1708 (code=exited, status=0/SUCCESS) Jan 15 09:11:42 drd systemd[1]: Starting PostgreSQL RDBMS... Jan 15 09:11:42 drd systemd[1]: Started PostgreSQL RDBMS. We can initialize the actual database with the  msfdb  command, which creates the default user, database, and relevant information pertaining to the database. ...