Often penetration testing engagements start with good old –*port scanning*–. Nmap is often the tool to use for it: nmap -p- [ip-address-here] –open -T3 -T argument is a parameter of time, and it is an important one. Here is the table illustrating different timing modes: Two important details from the table above: When this can…
Git is an open-source distributed version control system that is available to all kinds of users for free. Git tools work in conjugation with Git repositories. OK, now in human language…when you see a .git directory in a web app – it is good. It means the web app developer by mistake (or not?) deployed…
Hi everyone! Here is my second walkthrough. Let’s start with nmap: nmap -A 10.10.10.165 (We use -A flag for OS detection, version detection, script scanning and traceroute) As we can see, two ports are open: 22 – SSH, and 80 – HTTP. And we can notice the interesting web server nostromo 1.9.6. I suggest first…
It’s one of the easiest machines on Hack The Box which is good for beginners. Therefore I will try to explain my every step thoroughly. We will start from port scanning with nmap: nmap -A 10.10.10.242 -Pn (We use -A flag for OS detection, version detection, script scanning, traceroute and -Pn for not pinging the…
In one of the engagements I was assigned an interesting case. The web application was obviously vulnerable to SQL injection, but WAF (web-application firewalls) were blocking any data exfiltration attempts. So the question arose how to get data? But we will start from the beginning. One of the POST search parameters appeared to be vulnerable…
During a penetration test, there may be a scenario where we would like to gain a shell on the system we can execute commands on, however we may not be able to do so because both outbound and inbound ports are blocked. However, we may still gain Reverse Shell connection without using ports at all.…
Hi everyone! I successfully passed eJPT exam a few days ago and would like to share my experience with you. Does eJPT worth it? INE program for preparing for the exam is free, certificate costs only 200$ and includes 2 tries, therefore it’s definitely a good opportunity for a novice to start your hacking journey…
