🔐 Enumeration and Exploitation of JSON Web Tokens (JWT) JSON Web Tokens (JWT) are the most common mechanism nowadays for handling authentication and authorization in web applications. It’s an open standard (RFC 7519) that defines a compact format for transmitting signed information between client and server. The problem is that many implementations blindly trust the […]
🕵️ LFI: when the server reads what you want, not what it should 📂 We already understood what file inclusion vulnerabilities are and why they occur. Now it’s time for the practical step: exploiting them in different scenarios to read local files from the back-end server. A well-exploited Local File Inclusion (LFI) can leak configurations,
Scanning machines Initial scan ssh-keygen -f ‘/root/.ssh/known_hosts’ -R ‘172.17.0.3’ nmap -p- –open -sS –min-rate 5000 -vvv -n -Pn 172.16.116.200 -oG allPorts ## ligolo nmap -p- -sT -Pn -n –min-rate 500 -T3 172.16.116.200 -vvv -oG allPorts ## vulnlab nmap -p- -sS –min-rate 1000 T4 10.10.121.28 -oG allPorts nmap -p- -vvv –min-rate 1000 -oG allPorts ## UDP