TASK1: SSH into the server above with the provided credentials, and use the ‘-p xxxxxx’ to specify the port shown above. Once you login, try to find a way to move to ‘user2’, to get the flag in ‘/home/user2/flag.txt’. We connected to the target system using the provided credentials with…

I started to solving XSS Labs on the PortSwigger. The previous XSS labs were straightforward, but in this example, I needed one more step. After reading the source code, I found something interesting to focus on it. Let’s try to understand the what the source code does. $(window).on('hashchange', function(){...With this part…

The solution of the lab was hidden in the source code, and since solving it resembled a bit of puzzle solving, I think it was a very enjoyable lab. <script> var searchTerms='here'; document.write('img src = "/resources/images/tracker.gif?searchTerms='encodeURIComponent(searchTerms)+'">'); </script> During the document.write …

After learning the techniques for exploiting XXE vulnerability, it is time to explore exploiting XXE with a local DTD. This technique becomes necessary when some restrictions on the application server prevent you from declaring external DTDs. A local DTD refers to a .dtd …

I tried several methods but I will focus on explaining the solution and the underlying logic. I won’t cover the discovery part of the vulnerability. The things are happening on the raw content of the email, specifically the HTML components within the received email. <p>Hello!</p><p>Please <a href=’https://0a74005d04afe10a80a90d2f00560028.web-security-academy.net/login'> click here</a> to…

In this example of the portswigger, the lab’s name provices a hint: We will be using caching mechanism and host header attacks. Firstly, send a request to the “/” endpoint and observe the behavior. Everythings as it expected. Next, let’s proceed to manipulate the host header and analyze the response. …

Hello! Lately, I’ve become interested in hardware security, and Bluetooth has always fascinated me. In this blog, I won’t explain what BLE is and what it’s used for, but I will discuss a BLE CTF. Firstly, you need an ESP32 and a Bluetooth dongle to get started. Although you may…

After I reading the blog post on PostSwigger about ServiceNow admin credentials being exposed, I started to wonder if all the credentials have been gathered. I get to work without a moment’s delay, but I realized that I didn’t know how to find subdomains. All I know is, there can…

Explanation of the lab : This lab has a stock check feature which fetches data from an internal system. To solve the lab, change the stock check URL to access the admin interface at http://192.168.0.12:8080/admin and delete the user carlos. …