-
./missing-semester - Shell Tools and Scripting - Exercises
Course located at: missing.csail.mit.edu Exercises Read man ls and write an ls command that lists files in the following manner Includes all files, including hidden files Sizes are listed in human readable format (e.g. 454M instead of 454279954) Files are ordered by recency Output is colorized $ ls -ahltc -rw-r--r--...
-
./missing-semester - Course Overview + The Shell - Exercises
Course located at: missing.csail.mit.edu Exercises For this course, you need to be using a Unix shell like Bash or ZSH. If you are on Linux or macOS, you don’t have to do anything special. If you are on Windows, you need to make sure you are not running cmd.exe or...
-
Google XSS Game
Google XSS Game can be located at xss-game.appspot.com. Prompt Warning: You are entering the XSS game area Welcome, recruit! Cross-site scripting (XSS) bugs are one of the most common and dangerous types of vulnerabilities in Web applications. These nasty buggers can allow your enemies to steal or modify user data...
-
Zero to Hero: Pentesting Course
I finished The Cyber Mentor’s 15 hour Full Ethical Hacking Course - Beginner Network Penetration Testing (2019) today. The hands-on labs were great, and I think Heath Adams is a wonderful teacher. I only wish I started the course when it first came out! I’d recommend it to anyone that...
-
pwnable.kr - coin1
Prompt Mommy, I wanna play a game! (if your network response time is too slow, try nc 0 9007 inside pwnable.kr server) Running at : nc pwnable.kr 9007 Analysis noble@heart:~$ nc pwnable.kr 9007 --------------------------------------------------- - Shall we play a game? - --------------------------------------------------- You have given some gold coins in your...
-
TryHackMe - Ignite
Enumeration nmap root@kali:~/Security/TryHackMe/ignite# portscan 10.10.164.23 Open ports: 80 Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-30 16:05 EDT Nmap scan report for 10.10.164.23 Host is up (0.15s latency). PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) | http-robots.txt: 1 disallowed entry |_/fuel/ |_http-title: Welcome to FUEL CMS...
-
HackTheBox - SneakyMailer
Enumeration root@kali:~# portscan sneakymailer Open ports: 21,22,25,80,143,993,8080 Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-22 18:32 EDT Nmap scan report for sneakymailer (10.10.10.197) Host is up (0.075s latency). PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048...
-
pwnable.kr - shellshock
Prompt Mommy, there was a shocking news about bash. I bet you already know, but lets just make it sure :) ssh shellshock@pwnable.kr -p2222 (pw:guest) Analysis We have an executable called shellshock, its source shellshock.c, and a bash executable. Let’s check permissions: shellshock@pwnable:~$ ls -l total 960 -r-xr-xr-x 1 root...
-
TryHackMe - Overpass
Prompt What happens when a group of broke Computer Science students try to make a password manager? Obviously a perfect commercial success! Enumeration $ portscan 10.10.172.155 Open ports: 22,80 Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-23 16:39 EDT Nmap scan report for 10.10.172.155 Host is up (0.17s latency). PORT...
-
247/CTF - THE IMPOSSIBLE USER
Prompt This encryption service will encrypt almost any plaintext. Can you abuse the implementation to actually encrypt every plaintext? Source from Crypto.Cipher import AES from flask import Flask, request from secret import flag, aes_key, secret_key app = Flask(__name__) app.config['SECRET_KEY'] = secret_key app.config['DEBUG'] = False flag_user = 'impossible_flag_user' class AESCipher(): def...