NMAP Scanning Added address in /etc/hosts and open the web page Upon clicking the link it asks for credentials. As we do not have any credentials I got the page below. I tried to view the source code and found the photobomb.js file. After opening that file I got the credentials. Username: pH0t0 Password: b0Mb!Continue reading “HackTheBox – Photobomb”
Tag Archives: penetrationtesting
HackTheBox – Precious
NMAP Scanning Add website to hosts file: Open the web service This website takes a web page URL and converts it into PDF. On examining the pdf, it shows that it is using pdfkit v0.8.6 version On searching we found vulnerability for mentioned version On studying the POC it looks like the URL parameter isContinue reading “HackTheBox – Precious”
Domain 2: Asset Security
Asset Types Asset Classification Asset Storage Apply appropriate controls based on classification Data is more valuable than the media Asset Security Data Classification Type of Data Data Stakeholders Data Remanence Data left over after a removal and deletion process Data Destruction Scoping Portion of standards that will be applicable for organization Tailoring Customizing standards asContinue reading “Domain 2: Asset Security”
Common Linux Privilege Escalation
Used room: https://tryhackme.com/room/commonlinuxprivesc Privilege Escalation is a practice. It mainly depends upon configuration done in the system that acts as a weakness to escalate the privileges. These configurations can be of many types. For e.g.: So, today or tonight we will see various methods to do privilege escalation in Linux. Step 1: Enumerate the machineContinue reading “Common Linux Privilege Escalation”
Net Sec Challenge
What is the highest port number being open less than 10,000? 8080 There is an open port outside the common 1000 ports; it is above 10,000. What is it? 10021 How many TCP ports are open? 6 What is the flag hidden in the HTTP server header? THM{web_server_25352} What is the flag hidden in theContinue reading “Net Sec Challenge”
AWS Infrastructure as Code (IaC)
IaC allows you to write a script to provision AWS resources. The benefit is that you provision resources in a reproducible manner that saves time. CloudFormation CloudFormation allows you to provision AWS resources using IaC. Features: Provides a repeatable process for provisioning resources. Works with most AWS services. Create templates for the resources you wantContinue reading “AWS Infrastructure as Code (IaC)”
AWS Migration Services
A lot of companies are migrating to the cloud, and they need inexpensive, fast, and secure ways to move their on-premises data to AWS. Data Migration Service (DMS) DMS helps you migrate databases to or within AWS. Features: Migrate on-premise databases to AWS. Supports homogeneous and heterogeneous migrations. Continuous data replication. Virtually no downtime. UseContinue reading “AWS Migration Services”
AWS Storage Services
Simple Storage Service – S3 S3 is an object storage service for the cloud that is highly available. Objects(files) are stored in buckets(directories). Unlimited storage that can hold millions of objects per bucket. Objects can be public or private. You can upload objects via the console, CLI, or programmatically within code using SDKs. Features YouContinue reading “AWS Storage Services”
Terminology Cheat Sheet
S. No. Term Meaning/Use 1 Access control list(ACL) Firewall on network level 2 Auto Scaling Automates the process of adding or removing instances based on traffic 3 Buckets Root – level folders 4 CloudFront Content delivery network (CDN) that allows you to store your content at “edge locations” located all around the world, allowing customersContinue reading “Terminology Cheat Sheet”
Cross-site Scripting
It is an injection attack where malicious JavaScript gets injected into a web application with the intention of being executed by other users. Types of XSS Reflected XSS Stored XSS DOM based XSS Blind XSS Reflected XSS Reflected XSS happens when user-supplied data in an HTTP request is included in the webpage source without anyContinue reading “Cross-site Scripting”
