Open Redirect: when a website trusts a URL too much 🔀 An Open Redirect is a vulnerability that occurs when an application redirects the user to a URL specified in a parameter (for example newurl or redirect) without validating that the destination belongs to a trusted domain. At first glance it seems harmless —after all, […]
🔓 Privilege escalation with Vim/Vi when running as SUDO One of the classic privilege escalation vectors on Linux appears when a user has permission to run vim or vi with sudo (for example, via an entry in /etc/sudoers like (ALL) NOPASSWD: /usr/bin/vim). Although at first glance it may seem like a harmless permission -“it can
🔐 Enumeration and Exploitation of JSON Web Tokens (JWT) JSON Web Tokens (JWT) are the most common mechanism nowadays for handling authentication and authorization in web applications. It’s an open standard (RFC 7519) that defines a compact format for transmitting signed information between client and server. The problem is that many implementations blindly trust the
🕵️ LFI: when the server reads what you want, not what it should 📂 We already understood what file inclusion vulnerabilities are and why they occur. Now it’s time for the practical step: exploiting them in different scenarios to read local files from the back-end server. A well-exploited Local File Inclusion (LFI) can leak configurations,
Scanning machines Initial scan ssh-keygen -f ‘/root/.ssh/known_hosts’ -R ‘172.17.0.3’ nmap -p- –open -sS –min-rate 5000 -vvv -n -Pn 172.16.116.200 -oG allPorts ## ligolo nmap -p- -sT -Pn -n –min-rate 500 -T3 172.16.116.200 -vvv -oG allPorts ## vulnlab nmap -p- -sS –min-rate 1000 T4 10.10.121.28 -oG allPorts nmap -p- -vvv –min-rate 1000 -oG allPorts ## UDP