Today, I found a vulnerability on a server which is has feature upload for docx file. I will try to explain how to exploit XXE vulnerability using docx file and how to find this vulnerability. So.. What is XXE Vulnerability? An XML External Entity attack is a type of attack against an application that parses …
In this weekend, I will try to write a walkthrough to the VulnHub Bulldog 1. You can download this CTF VM on VulnHub’s website. First, I need to find some open port on the target machine. nmap -p- 192.168.56.101 Starting Nmap 7.60 ( https://nmap.org ) at 2017-11-04 11:35 WIB Nmap scan report for 192.168.56.101 Host …
Fiddler is a free web debugging proxy which logs all HTTP(s) traffic between your computer and the Internet. Use it to debug traffic from virtually any application that supports a proxy like IE, Chrome, Safari, Firefox, Opera and more. Fiddler could be easily manipulate and edit web sessions. All you need to do is set …
Lets continue the last article since i was busy with my real life. From the last article i successfully get into the server from SSH service. Now lets enumerate the network inside the server based on this network diagram. First, lets check if Nmap already installed on the server: [email protected]:~$ nmap -version Nmap version 6.00 …
Playing Around With PentestIt.Ru Testlab v.10 – Part 2 Read More »
Lets playing around with pentestit.ru testlab v.10. Target IP : 192.168.101.9 Nmap : $ nmap 192.168.101.9 -A Starting Nmap 7.40 ( https://nmap.org ) at 2017-04-09 22:27 EDT Nmap scan report for gds.lab (192.168.101.9) Host is up (0.56s latency). Not shown: 995 filtered ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.0p1 Debian 4+deb7u6 (protocol 2.0) | …
Playing around with pentestit.ru testlab v.10 – Part 1 Read More »