The Ghost Operator's Signal
This is a 50 points task in PicoCTF to solve this puzzle. I have to admit that I sat on it for a while because I suspected a complex solution like using stenography or any other hidden clues in the image file. Finally I just sat down and it became obvious immediately.
Continue reading “PicoCTF: The Numbers [CTF Write Up]”
The PicoCTF web exploitation tasks are fun and you can learn a lot about the web and about the tools you can use as a white hat hacker or penetration tester. Knowing about the possible security issues can help you avoid them as well as a developer. Let’s see another web security challenge!
Continue reading “PicoCTF: Cookies [CTF Write Up]”
In the following CTF game the player looks into the HTTP communication and its request methods. It is a great opportunity to learn about what happens behind the scenes during loading a web page. The game is on PicoCTF.
Continue reading “PicoCTF: GET aHEAD [CTF Write Up]”
Have you ever thought about joining the forces of white hat hackers and penetration testers? Don’t you know where to start or how to practice some skills? Though capture the flag games, or CTFs in short, are not the most life-like situations, they can help you to build a way of thinking and to learn the basic tools. PicoCTF is a great site to start as a beginner.
Continue reading “PicoCTF: “where are the robots” [CTF Write Up]”RootMe is a bite sized WEB upload form and Linux privilege escalation exercise.
Continue reading “TryHackMe | RootMe [CTF write-up]”Microsoft Active Directory can be found at every medium/large organization (99% according to the THM room). This is why it is a common target for black hats and other malicious actors. In the Attacktive Directory room we can learn a lot about targeting the services in an AD.
I use the THM in-browser Kali Linux for this task!
Continue reading “TryHackMe | Attacktive Directory [write-up]”In this room we practice to enumerate and exploit vulnerabilities on Linux servers.
Let’s walk through the Vulnversity room of tryhackme.com. This write-up is written for educational purposes. Please do not use it for cheating or skipping the tasks.
In this presentation we will crack the password of a general Linux user via SSH in our personal lab. The machine from which we start the attack is a Kali Linux box, and the attacked machine is an ordinary Debian Linux on which a user set a weak password. Unfortunately the security settings are weak on the target host, so we have a great chance for success. We already know the name of the user.
Important note: cracking passwords in the wild is illegal! Do NOT do it out of the lab, unless you are a penetration tester with a signed contract!
Continue reading “How to brute force and crack SSH passwords with Hydra? Ethical Hacking in real practice!”In this article I go through the OWASP Juice Shop room of tryhackme.com. This room is a practical review of the OWASP Top 10 vulnerabilities. This is a base security consideration for those who want to develop web applications.
Tom's IT Cafe 