Penetration Testing

CTF Writeups

HTB Broker Writeup

Begin by adding the machine IP to /etc/hosts. nano /etc/hosts CTRL + S CTRL + X Conduct a port scan -> Service + default script scan: sudo nmap -sV -sC -Pn broker.htb Full port scan: sudo nmap -p- -Pn --min-rate 10000 broker.htb Identify all open ports: Service + script

CTF Writeups

HTB Bashed Writeup: From phpbash WebShell to Root via Cron Job Abuse

Begin by adding the machine IP to /etc/hosts. nano /etc/hosts Reconnaissance Conduct nmap scans respectively -> Full port scan: sudo nmap -p- -Pn --min-rate 10000 bashed.htb Full port coverage + skip host discovery to avoid ICMP-based false negatives on firewalled hosts. Service + default script scan: sudo nmap

CTF Writeups

HTB Mirai: Default Creds, Pi-hole & USB Forensics

Start by adding the machine IP to /etc/hosts. This avoids having to copy-paste the IP address on every command throughout the engagement. nano /etc/hosts Fast Service Scan nmap -sC -sV -T4 -Pn mirai.htb Port 22 (SSH), 53 (DNS), 80 (HTTP), and a few others are open. The

CTF Writeups

HTB Shocker: RCE via CGI-bin + Perl Privesc

Add the correlated IP address to the /etc/hosts file. Run the following nmap scans: nmap -sV -sC -Pn shocker.htbnmap -sV --script=vuln -Pn shocker.htb Service detection and banner grabbing with default scripts: Full port scan: Find non-standard ports faster with --min-rate: The service + CVE vulnerability scan took

CTF Writeups

HTB Return: LDAP Credential Theft to Service Hijacking

Add the target IP address to /etc/hosts and bind it to onurcan.htb or whatever you want xD Begin with a service scan on the most common ports: nmap -sV...