Hacking Articles|Raj Chandel's Blog
CAP HacktheBox Walkthrough

Today CAP – HTB machine will be our target. We will categorize this lab in the beginner's section to capture the flag. Here, we are going to learn about the capability binary approach of privilege escalation. Let's take a deep dive.

Penetration Testing MethodologyReconReconThe first thing always comes to mind is of doing Reconnaissance. Let’s start with the NMAP scan.Nmap –A 10.129.231.234https://blogger.googleusercontent.com/img/a/AVvXsEjfo01PNJAne_9ZswpkUXhYH-1XGE0gOEPR7ji-5-oojur0Rjt5imGCPV7l8AcHBs8s9E5b4DPD9K3D5tcwQSFLoFeA1wPxDwhyRe-5m2H_Y-TpCAvKrpM9LygccibdexmSjaTvesaxIttOMgMDF9ksMndn-882hDGuE-ilQK2da7UQRnqZM-YhZTxfaA=s16000 The scan result of NMAP shows that there are three important open ports i.e.  Port 21 –FTP service having vsftpd 3.0.3 version, Port 22 –SSH version 8.2p1, and Port 80- HTTP serviceEnumerationNow we investigate port 80 in a web browser which displays an interesting dashboard of monitoring results of security events. On the left-hand panel, there are four options mentioned as Dashboard, Security Snapshot (5second PCAP +Analysis), IP config, and Network status. Out of the four options, PCAP i.e. packet capture, the analysis looks interesting which contains the number of packets of TCP and UDP. After directory enumeration, we download the data 0 .pcap file. http://10.129.231.234/data/0https://blogger.googleusercontent.com/img/a/AVvXsEhvz7kuED4R312A1BawT_yNQht0aoE-JSx-NVLYEuNzYdgsrhRKHuMET2rcDPB3iCbFB_fKxXilEPpCXt6S9Two2dX-ZGTHIK_Zpca7sOj13RwV3VxefL0wM60P6unXF8GTWixX9m2zgDGeI97ugyXZu0ErwsKduLAbUbwEYnU9zj7tPbRb-e3cOOjWFg=s16000 The above-downloaded file we analyzed into Wireshark and filter out the FTP Protocol whose result display the credentials into clear text, below are the credentials are mentioned:Ssh nathan@10.129.231.234https://blogger.googleusercontent.com/img/a/AVvXsEjrLm1FE8d26yTEzkgK0dNtlRU8zeUaq6X8xPtAkEZpvniK9v0DpZRWO_ali6UaBA2NXdSRDxdiqhCGq3_QuNSSsNhKih0mLWjuaILHKe_oN-dwHXi2rbUVSYX3Ay2GxE5ofk0pB97xzhsR4QcQRO75Ucsete6B0QClL7H7YLzZV6bdnhCTUckBfCbeSQ=s16000 Privilege EscalationTo enumerate the HTB machine and escalate privileges, we'll utilize the LinPEAS post-exploitation script.Ls We already had the script on the Kali machine, so we host it on port 80 and then will download it using wget from the /tmp directory on the htb machine. Now we give it the necessary execution rights, and then we [...]

___________________________
@hacking_Attack
@Hacking_Video

run LinPEAS.Cd /tmp /linpeas.shhttps://blogger.googleusercontent.com/img/a/AVvXsEgmwIGzpxPQTLADlrR_aFwsK2nlLnYx_vkwUnxfICIDvYceNpTeDu0f8niW15BDLDOrPM0-WWP60k3THoYOD--MxnJMtLQgqnCM_nCmjtxPWdeGXPt5rDz4zTGBgaoC3g4oATjVEROGj0dJan_Q4Oj7cct30e4Mt1-MHiYJudX8scODCcFxkt6Tz_LLKg=s16000 For the Privilege Escalation section, the LINPEAS result reveals an interesting finding concerning cap setuid on Python 3.8's binary, which is how the machine got its name.python3 -c 'import os; os.setuid(0); os.system("/bin/bash")' Finally we capture the root flag.___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
CAP HacktheBox Walkthrough

Today CAP – HTB machine will be our target. We will categorize this lab in the beginner’s section to capture the flag. Here, we are going to learn about the capability binary approach of privilege escalation. Let’s take a deep dive. Penetration Testing Methodology  Recon Nmap Enumeration Web Enumeration Wireshark

The post CAP HacktheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

A Tale of Weird XSS into $100
https://medium.com/@nithissh/a-tale-of-weird-xss-into-100-4cd451fe79d4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey Guys , How are you all ? . I hope so your doing good and healthy . So, Lets get started . So , I started searching for bugbounty…Continue reading on Medium » (https://medium.com/@nithissh/a-tale-of-weird-xss-into-100-4cd451fe79d4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Beginner Bug Bounty Resources
https://spoilyzer.medium.com/beginner-bug-bounty-resources-4e0f8dc822b4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello everyone! 👋🏼Continue reading on Medium » (https://spoilyzer.medium.com/beginner-bug-bounty-resources-4e0f8dc822b4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
The 5 Phases of Zero-Trust Adoption

Zero trust aims to replace implicit trust with explicit, continuously adaptive trust across users, devices, networks, applications, and data.

Dark Reading: Attacks/Breaches
IDrive Remote Desktop Offers Protection from RDP Cyberattacks and Vulnerabilities

Remote Desktop aims to solve vulnerability issues with RDP by implementing robust access and security controls.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Forcepoint to Acquire Bitglass

Deal will merge Bitglass's security service edge technology with Forcepoint’s SASE architecture.

___________________________
@hacking_Attack
@Hacking_Video

Why is android smali code reversible and JADX one not
https://www.reddit.com/r/redteamsec/comments/q60fxr/why_is_android_smali_code_reversible_and_jadx_one/

Hi, why an android apk file decompiled by smali to dalvik bytecode is reversible and the java decompiled one using JADX is not ? submitted by /u/Spare_Prize1148 (https://www.reddit.com/user/Spare_Prize1148)
[link] (https://www.reddit.com/r/redteamsec/comments/q60fxr/why_is_android_smali_code_reversible_and_jadx_one/) [comments] (https://www.reddit.com/r/redteamsec/comments/q60fxr/why_is_android_smali_code_reversible_and_jadx_one/)

___________________________
@hacking_Attack
@Hacking_Video

Beginner Bug Bounty Resources

Hello everyone! 👋🏼Continue reading on Medium »
Read more...

hacking: security in practice
Bypassing linux server authentication by exploiting osvdb-3092?

So I was given a .ova file containing a linux webserver running apache. We were supposed to retrieve a key from the server but no password was given except to use guest as user. I ran a nikto search to find vulnerabilities in the server and came across OSVDB-3092. A quick google search showed me that CVE-2006-3092 can be exploited to "bypass authentication and modify data via direct requests with modified parameters to 1) /tva/ajouter_tva.php, (2) /remises/ajouter_remise.php, (3) /pays/ajouter_pays.php, (4) /pays/modifier_pays.php, (5) /produits/ajouter_cat.php, (6) /produits/ajouter_produit.php, (7) /clients/ajouter_client.php, (8) /clients/modifier_client.php."

I'm stuck on the last part and wasn't able to find anything on google. Still pretty new to hacking so less technical replies are appreciated. Also what is a good way to document my findings?

submitted by /u/Razeratorr
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Using Brim to analyse some malicious traffic, can be useful for cyber forensics/blue teamers

https://external-preview.redd.it/6FjQgnRQVwQrBT0fGD-I2KtFbvcENV3GElr4AzsDdaI.jpg?width=320&crop=smart&auto=webp&s=6cafe59693e84d1610ef656806b5c32831daf8f8 submitted by /u/the_simp_lust_man
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video