Part 1 Brute-forcing methods: offline (a.k.a offline password cracking) online (e.g. login forms) I’ve seen people on twitter often mentioning wfuzz and ffuf for login brute-forcing. However, these notes are about the usage of thehydra tool. To install it on your local VM: apt install hydra -y There can be…

Setup and usage. About pyenv Python version manager; You can have any/multiple versions of python running on your system, and now you can keep running your old scripts. Install Homebrew brew update brew install pyenv echo 'export PYENV_ROOT="$HOME/.pyenv"' >> ~/.bashrc echo 'command -v pyenv >/dev/null || export PATH="$PYENV_ROOT/bin:$PATH"' >> ~/.bashrc …

Cyber Kill Chain phases described in short notes. An abstract model focused on adversary’s actions and describes phases of cyber attack. Recon Gaining information about the target. Hard data vs Soft data Active vs Passive recon OSINT Email harvesting the process of obtaining email addresses from public, paid, or free services; …

One red team test. Security is mostly a superstition. It does not exist in nature, nor do the children of men as a whole experience it. Avoiding danger is no safer in the long run than outright exposure. Life is either a daring adventure, or nothing ~ Helen Keller With…

A Beginner level box with basic web enumeration and REST API Fuzzing. Lessons learned. — The Challenge Description Bookstore is a boot2root CTF machine that teaches a beginner penetration tester basic web enumeration and REST API Fuzzing. Several hints can be found when enumerating the services, the idea is to understand how a vulnerable API can be exploited -source There are two flags to be captured:

At the time all I knew about it is the name itself and that it is one of the top recognized certifications in the industry. I was told that it will not be easy and that you need to have a certain mindset to pass it. …

Tampermonkey is a game changer when it comes to tampering with your browser. — Tampermonkey exists as a browser extension for Chrome, Microsoft Edge, Safari, Opera Next, and Firefox. This browser extension enables you to create and manage userscripts (written in JavaScript) to modify web pages, for example, changing the layout, adding or removing content or functionality and all things automation.

tqdm derives from the Arabic word taqaddum (تقدّم) which can mean "progress," and is an abbreviation for "I love you so much" in Spanish (te quiero demasiado). There are already quite few resources related to how to do things in tqdm(), however they are all describing somewhat complex scenarios, and…

A walkthrough. Start with nmap. nmap -A -vv target_ip You will find web servers on port 80 and 8080. I did reverse image search and got the answer. Another way to do this is to Inspect the page and check the image element. Task 1: Introduction Who is the employee of the month? …