Hey everyone, hope you all are doing good. This will be a short walkthrough for the Command Injection-2282 Lab by Pentester Academy. Lab Link: https://attackdefense.pentesteracademy.com/challengedetails?cid=2282 Intro We are given a URL to a webapp https://cwlw44ht84.execute-api.ap-southeast-1.amazonaws.com/Prod. It allows us to upload files. Upload a file by drag and drop and intercept the…

Enumeration TCP Port Scan Web server enumeration From the nmap output, we can see that the port 80 is redirecting to http://devzat.htb. We will need to add the hostname devzat.htb on our hosts file to be able to visit the website.

Difficulty: Medium Room Description: No logs, no crime… so says the lumberjack. Hey folks, here is the writeup for the Lumberjack Turtle room from TryHackme. Enumeration Nmap Website (Port 80) Visiting any random non-existent page (/test) throws this error with 404 status code. Visiting /error gives the status=999 in the error message with 500…

A brief intro Execution After Redirect (EAR) is an attack where an attacker ignores redirects and retrieves sensitive content intended for authenticated users. A successful EAR exploit can lead to complete compromise of the application. Consider a web application that has login functionality. Users who have an account can access content/features in this…

Hello everyone, hope you all are doing great. I’m planning to write some blogs (you can call it a series of blogs) on Buffer Overflows. I will be posting all of them one by one in the coming weeks. Since we will be smashing the stack when doing buffer overflows…

Hello all, today we be doing Zeno from TryHackMe. It is rated Medium and the description says “Do you have the same patience as the great stoic philosopher Zeno? Try it out!” Port scanning There was some problem with nmap and because of that it wasn’t able to show all the open…

Hi all, today we will take on the IDE room in TryHackMe. It is rated Easy and the room description says: “An easy box to polish your enumeration skills!” So, in the nmap scan, we get four services:

Hello everyone, this one is going to be the write-up for the Sweettooth Inc. room on TryHackMe. In this room, we’ll have to first enumerate a vulnerable database where we have to craft a JWT token to login into it and there we get the SSH credentials to the system…

Hello all, this is my first HTB write-up and I’m starting off with Spectra which retired just recently. So, lets begin :) Let’s first start off with a nmap scan. nmap -T4 -sV -sC -p- -oN spectra.nmap -v 10.10.10.229 Scan results: Nmap scan report for spectra.htb (10.10.10.229) Host is up (0.13s…