Freaks City

Target Objective The mission is to retrieve two flags: user.txt and root.txt. The latter requires elevated privileges, necessitating privilege escalation after initial access. Setup Attacker: Kali Linux (IP: 192.168.80.129) Target VM: Download from https://download.vulnhub.com/ha/narak.ova Reconnaissance Active Host Discovery Scan the subne ...

Bypassing Input Filters During manual SQL injection testing, web applications often implement strict input validation that filters critical characters such as spaces and the equals sign (=). To successfully exploit such vulnerabilities, an attacker must obfuscate the payload to bypass these rules. Inline comments (/**/) serve as an effectiev su ...

Cookies Cookies are key-value pairs stored by the browser on the client side. When a server sends a Set-Cookie header in an HTTP response, the browser saves it locally and includes it in subsequent requests to the same domain. Browsers enforce limits on cookie size and quantity per domain to prevent abuse and excessive disk usage. Sessions Sess ...

Introduction to Web Application Security TestingWeb applications have become integral to modern business operations, spanning from government portals to financial services and social platforms. This ubiquity makes them attractive targets for malicious actors seeking to exploit vulnerabilities for data theft or service disruption. Organizations ...

Nmap is a staple tool for network reconnaissance, but parsing its output efficiently is crucial for streamlining the penetration testing workflow. Rather than performing repetitive scans for different services, it is often more efficient to perform a comprehensive scan once and parse the output. Nmap's greppable output format (-oG) is particula ...

HackerGPT serves as a digital assistant tailored for cybersecurity professionals. This AI tool maintains an extensive knowledge base covering penetration testing methodologies, security tools, and defensive strategies. It functions as both an information resource and active participant in security analysis workflows, accommodating users renging ...

Introduction to the Book Learning Kali Linux 2019 is a comprehensive resource packed with practical exercises, designed with a student-centric approach that makes it easy to follow each chapter. The book begins by introducing ethical hacking concepts and threat actors, then transitions into penetration testing methodologies. Each chapter flows ...

Complete penetration testing example Process outline Introduction I completed this internal penetration testing lab at the beginning of 2021, but I didn't maintain it for a long time. Then I went to a CTF site and solved a lot of problems, improving my ranking from 20,000 to 200. After solving CTF problems, there were various exams, and it took ...

SQL injection represents the most critical risk in web application security, often resulting in full compromise of backend data stores. Modern web applications rely on databases to store user accounts, preferences, content, and nearly all persistant information. Instead of generating static pages for each user, server-side scripts construct dyn ...

Running Kali Linux inside a lightweight container is a quick way to spin up a disposable penetration-testing lab. The steps below show how to provsiion the distribution with Docker Compose, map useful ports, and persist your tools and findings on the host. Prerequisites A Linux host with sudo access (Ubuntu 22.04 is used in the examples). Outb ...