6 days ago

Process Injection

Whenever we’ll get a reverse shell, it’s mostly spawned by creating a new separate process, if that process gets killed, could be because of the target machine or the victim may kill the process by closing the application our reverse shell will die So this is where the technique of…

Windows

8 min read

Jul 30

Portswigger Insecure Deserialization — Lab 3

Using application functionality to exploit insecure deserialization In this lab we need to modify the serialized cookie for the account either for wiener or gregg and delete morale.txt from carlos user's home directory

Ctf

3 min read

Portswigger Insecure Deserialization — Lab 3

Jul 30

HackTheBox — Late

Late was an easy rated linux box which had subdomain having the functionality to convert image having some text into a text file, as it was made with flask, the application was vulnerable to SSTI (Server Side Template Injection) through which we can read ssh key svc_acc user, although it…

Ctf

4 min read

Jul 29

Portswigger Insecure Deserialization — Lab 2

Modifying serialized data types In this lab we need to modify the serialized session which is vulnerable to authentication bypass through which we can get access to administrator account

Portswigger

3 min read

Jul 29

Portswigger Insecure Deserialization — Lab 1

Modifying serialized objects In this lab we need to modify the session cookie which is using serialization through which we need to escalate our privileges to administrator user and then delete the carlos user

Ctf

2 min read

Portswigger Insecure Deserialization — Lab 1

Jul 23

HackTheBox-Catch

Catch was a medium rated linux box, involved an apk having few tokens out of which we were able to use let’s chat token on the API giving us the credentials to catchetwhich was vulnerable to CVE 2021–39174, leaking the variables from .env …

Ctf

10 min read

Jul 16

HackTheBox-Acute

Acute was hard rated box which involved enumerating the web site to find a word document having the link to PowerShell Web Access (PSWA) also having the hostname in meta data and the password in the document, the username was found through the about page from the site, giving us…

Ctf

13 min read

Jul 9

HackTheBox — RouterSpace

Routerspace was an easy rated linux box which had an android application through which we need to either extract the URL or intercept request which the application was being vulnerable command injection due to unsanitized user input to get a shell as paul, escalating to root was simple as with…

Ctf

5 min read

Jul 7

Portswigger JWT — Lab 3

JWT authentication bypass via weak signing key In this lab we need to modify the JWT of the user we log in and brute force the secret key to sign JWT and edit JWT to become administrator user.

Portswigger

2 min read

Portswigger JWT — Lab 3

JWT authentication bypass via weak signing key

In this lab we need to modify the JWT of the user we log in and brute force the secret key to sign JWT and edit JWT to become administrator user.

Jul 7

Portswigger JWT — Lab 2

JWT authentication bypass via flawed signature verification In this lab we need bypass authentication via flawed JWT signature verification to become the administrator user by modifying token and access /admin , we can login with the credentials wiener:peter as a normal user

Jwt

2 min read

Portswigger JWT — Lab 2

JWT authentication bypass via flawed signature verification

In this lab we need bypass authentication via flawed JWT signature verification to become the administrator user by modifying token and access /admin , we can login with the credentials wiener:peter as a normal user

Process Injection

Portswigger Insecure Deserialization — Lab 3

HackTheBox — Late

Portswigger Insecure Deserialization — Lab 2

Portswigger Insecure Deserialization — Lab 1

HackTheBox-Catch

HackTheBox-Acute

HackTheBox — RouterSpace

Portswigger JWT — Lab 3

Portswigger JWT — Lab 3

JWT authentication bypass via weak signing key

Portswigger JWT — Lab 2

Portswigger JWT — Lab 2

JWT authentication bypass via flawed signature verification

ARZ101