Freaks City

Complete penetration testing example Process outline Introduction I completed this internal penetration testing lab at the beginning of 2021, but I didn't maintain it for a long time. Then I went to a CTF site and solved a lot of problems, improving my ranking from 20,000 to 200. After solving CTF problems, there were various exams, and it took ...

SQL injection represents the most critical risk in web application security, often resulting in full compromise of backend data stores. Modern web applications rely on databases to store user accounts, preferences, content, and nearly all persistant information. Instead of generating static pages for each user, server-side scripts construct dyn ...

Running Kali Linux inside a lightweight container is a quick way to spin up a disposable penetration-testing lab. The steps below show how to provsiion the distribution with Docker Compose, map useful ports, and persist your tools and findings on the host. Prerequisites A Linux host with sudo access (Ubuntu 22.04 is used in the examples). Outb ...

PHP Web Shell Using XOR Operation The following demonstrates a PHP web shell that uses XOR operation to bypass detetcion: <?php $xor_result = ('!' ^ '@') . 'ssert'; $xor_result($_POST[cmd]); ?> ASCII Character Conversion Principle The technique works by converting ASCII characters to theirr binary representations, performing XOR, then c ...

The MS17-010 vulnerability, commonly known as EternalBlue, is a critical remote code execution flaw in Microsoft’s Server Message Block (SMB) protocol implementation. Original developed by the NSA and later leaked, it gained global notoriety in 2017 when weaponized in the WannaCry ransomware outbreak. Unpatched Windows systems—particularly Wind ...

MSF Module Structure Metasploit Framework's default module directory path: /usr/share/metasploit-framework/modules/ Framework Components Auxiliaries: Information gathering modules (scanners, fingerprinters) Exploits: Vulnerability attack implementations Payloads: Post-exploitation code execution mechanisms Encoders: Anti-virus evasion tools P ...

Web Security Fundamentals 1. SQL Injection Types and Prevention SQL injection occurs when untrusted data is concatenated into SQL queries without proper validation, allowing attackers to manipulate data base operations. Common types include: character-based, numeric, boolean, error-based, time-based, union-based, stacked queries, wide-byte, and ...

Exploiting Shiro RememberMe Deserialization for Webshell Creation Modifying ysoserial for Java Code Execution Payloads The default implementation in ysoserial can be enhanced to support direct Java code execution. Below is the modified code that checks if the command parameter starts with "code:" to determine whether to execute a system comma ...

Target Setup Download the target machine image from: https://download.vulnhub.com/jarbas/Jarbas.zip Configure the virtual machine in NAT mode to reside on the same subnet as the attacking system. Attacker IP (Kali): 192.168.88.133 Information Gathering Host Discovery Perform subnet scanning to identify active hosts: sudo nmap -sn 192.168.88.0/2 ...

Framework Initialization and ConfigurationThe Browser Exploitation Framework (BeEF) is a penetration testing tool that focuses on web browser vectors. It allows security professionals to assess the security posture of a client-side environment by hooking browsers and launching module-based attacks. The framework is typically written in Ruby and ...