All forms of input to an application needs to be validated. For example, to notify a user about suspicious typos or for security reasons. The easiest form of validation is probably of integers, ie the input cannot consist of anything…
Nagios XI version 5.11.0 and 5.11.1 are vulnerable to SQL injections. There are several endpoints in the Nagios XI suite that are vulnerable to SQLi. However, the endpoint referred to in CVE-2023-40931 might be exploited by an unprivileged user. Method:POST…
Here is some hints for the HTB web challenge ApacheBlaze (easy) Step into the ApacheBlaze universe.. Burp is your friend for this challenge! Console log the X-Forward-Host header with app.logger.error(…) in order to see if your request is triggering any…
“A case study of unauthorized login attempts against honeypots via remote desktop” Abstract and information about the thesis in DiVA (open access):https://www.diva-portal.org/smash/record.jsf?dswid=5536&faces-redirect=true&language=en&searchType=SIMPLE&query=&af=[]&aq=[[]]&aq2=[[]]&aqe=[]&pid=diva2%3A1784631&noOfRows=50&sortOrder=author_sort_asc&sortOrder2=title_sort_asc&onlyFullText=false&sf=all Full text of the study can be downloaded from:
Qterminal in Kali Linux After an update, the terminal in Kali Linux got some strange behavior. When using the arrow keys to complete commands or scrolling through history it produced the characters A (up arrow) B (right arrow) C (right)…
Seasonal machine at hack the box is a Linux instance with Apache 2.4.52. I’ve seen a lot of people struggling to find a functional and working reverse shell after they got the initial foothold. From an initial foothold it is…
Working with a payload for a buffer overflow shellcode. For this particular task the payload needs to be reversed i.e “\x01\x02” should be “\x02\x01” etc. Didn’t find any online conversion tools so I wrote my one using C#. It could…
Research proposal AbstractConstantly, around the clock, reconnaissance is conducted for vulnerable systems and services around the world. This is done manually or automated by malicious actors and can be more or less systematic. To carry out these reconnaissance, tools are…
Local privilege escalation using polkit Exploit CVE-2021-3560 is used for privilege escalation on linux systems. It’s related to polkit and D-bus requests. ”polkit is an application-level toolkit for defining and handling the policy that allows unprivileged processes to speak to…
Some hints to the web challenge EasterBunny @ HTB: Look into if you can poison some header. Find the postman. Hope you find the correct Path..Good luck!
If you struggle with the web challenge Neonify at HTB, here comes some hints! Look in to the end of the line? Where is flag? May the encoding be with you..Good luck and let me know if any hint was…
If there is problems start a local development server in .net core version 6 web app using SSL. You can disable SSL in the launch profile. When I started a new website today in the local dev I got the…