The Ghost Operator's Signal
In the following CTF game the player looks into the HTTP communication and its request methods. It is a great opportunity to learn about what happens behind the scenes during loading a web page. The game is on PicoCTF.
Continue reading “PicoCTF: GET aHEAD [CTF Write Up]”
Have you ever thought about joining the forces of white hat hackers and penetration testers? Don’t you know where to start or how to practice some skills? Though capture the flag games, or CTFs in short, are not the most life-like situations, they can help you to build a way of thinking and to learn the basic tools. PicoCTF is a great site to start as a beginner.
Continue reading “PicoCTF: “where are the robots” [CTF Write Up]”
You learned about the hidden part of the internet, the Tor hidden services. Then you downloaded and configured your Tor browser for the first deep dive into this unknown territory. As I mentioned before, the hidden services is a region of the internet that is not crawled and indexed by ordinary search engines like Google and Bing. You have to know the .onion URL of the site that you are looking for. These URLs are not the usual easy-to-remember domain names you see in the clear web. The hidden services URLs are generated text with the .onion ending. Luckily there are popular link collections and wiki sites as your entry points to the hidden services.
Continue reading “Tor Hidden Services: Reaching The First Entry Point”
After my previous article about the deep web and the Tor hidden services you know just enough to be curious: what lies behind the gates of the Onion Routing protocol? To figure it out you need an instance of the Tor browser connected to the Tor network. Before you jump right to a download link, please do a bit of research yourself about the Tor project and its tools and affiliates. It is interesting to take a look at the Tor metrics and understand its data. The growing usage of Tor relays talks about a constantly growing user base. At a peak time in the beginning of February, 2024 there were more than 7.5 million users online on the relays. It was only about 4 million in the end of 2023. Before you continue this journey into the hidden services read about information safety and be notified that this area of the internet is dangerous!
Continue reading “Tor Hidden Services: Preparing For Reaching The Hidden Area”
As a child in the ’90s I was fascinated by the internet. That tiny browser window in a flashing CRT display became a portal to an exciting world. Not much later, in the early 2000s I realized that the online land of possibilities has another side. The hidden part of the internet is protected by a chain of relays and a tool that is specially developed to reach this area. No ordinary web browser can surf this web, nor the search engines like Google can index and show them in search results. The Tor hidden services was all over in the news in the 2010s because of its dark and lawless side. The Silk Road was taken down by the authorities in October 2013. Ross Ulbricht, the alleged founder and operator of the Silk Road, was arrested and later convicted on multiple charges. The case drew significant attention due to its connection to the dark web and the use of cryptocurrency (particularly Bitcoin) for transactions on the platform. The hidden services and the onion routing was developed for a very different purpose: to help people stay anonymous from governments, dictatorship and to help whistleblowers, journalists and the free speech.
Continue reading “Tor Hidden Services: Privacy On The Internet And Dark Things”
In today’s connected world, ensuring the security of web communications is very important. Encrypting data exchanged between users and websites is a mandatory step in protecting sensitive information and privacy. Let’s Encrypt, a free, automated, and open certificate authority, coupled with Certbot, a robust tool for automatically managing SSL/TLS certificates, provides a powerful solution for making the web a safer place. In this post, we will explore the process of implementing Let’s Encrypt and Certbot on Debian Linux to enhance web security.
Continue reading “Installing and Automating Let’s Encrypt Certificates with Certbot”
NGINX, pronounced “engine-ex,” is an open-source web server software used for various purposes, including web serving, reverse proxying, caching, load balancing, and media streaming. It was initially designed to handle large numbers of concurrent connections, making it suitable for high-performance web applications.
Continue reading “How To Set Up Vhosts In The Nginx Webserver?”
Apache is a free and open-source cross-platform web server software that allows users to deploy their websites on the internet. It was launched in 1995 and has been the most popular web server on the Internet since April 1996.
A reverse proxy is a server that sits in front of web servers and forwards client requests to those web servers. It acts as an intermediary, intercepting and inspecting incoming client requests before forwarding them to the web server. Reverse proxies can provide additional levels of abstraction, control, security, and performance optimization. They are commonly used for load balancing, web acceleration, and to hide implementation details about the web servers.
SSL, or Secure Sockets Layer, is a protocol for establishing authenticated and encrypted links between networked computers. Its current iteration is called TLS (Transport Layer Security).
Continue reading “How To Configure An Apache SSL Reverse Proxy on Linux?”In the ever-evolving landscape of cyber security, staying ahead of the curve is not just a preference but a necessity. Continuous learning and hands-on practice are crucial components of honing the skills required to defend againsTryHackMet the relentless onslaught of cyber threats. TryHackMe, a leading platform for cyber security education, has introduced an innovative and festive approach to learning with its Advent of Cyber series. This blog post explores the unique features that make TryHackMe’s Advent of Cyber a valuable resource for individuals seeking to enhance their cyber security prowess.
If you have been doing the TryHackMe Simple CTF challenge recently, you may have ran into the problem that the original exploit is written in Python 2 for Ubuntu 18.04. The script can be converted or rewritten to Python 3, but my Debian Bookworm attack box had issues running it and showing the result. I came up with a quick solution using docker.io.
Continue reading “TryHackMe | Simple CTF – Modern Solution (2023) Working Exploit With Docker.io”RootMe is a bite sized WEB upload form and Linux privilege escalation exercise.
Continue reading “TryHackMe | RootMe [CTF write-up]”Microsoft Active Directory can be found at every medium/large organization (99% according to the THM room). This is why it is a common target for black hats and other malicious actors. In the Attacktive Directory room we can learn a lot about targeting the services in an AD.
I use the THM in-browser Kali Linux for this task!
Continue reading “TryHackMe | Attacktive Directory [write-up]”In this room we practice to enumerate and exploit vulnerabilities on Linux servers.
Let’s walk through the Vulnversity room of tryhackme.com. This write-up is written for educational purposes. Please do not use it for cheating or skipping the tasks.
In this article I go through the OWASP Juice Shop room of tryhackme.com. This room is a practical review of the OWASP Top 10 vulnerabilities. This is a base security consideration for those who want to develop web applications.
Tom's IT Cafe 