Pentesting

Continuing from the previous post (Mac pentest series): Installing Homebrew without sudo privilege (Mac pentest series) Install Homebrew without sudo privilege Recently, my company provided me with a 2023 MacBook Pro, equipped with the M2 chip, as a replacement for my old Lenovo…chennylmf.medium.com Today, I’d like to share a method for installing applications on macOS without requiring an admin password. This approach is particularly useful in cases where the Apple App Store is disabled to prevent users from directly downloading…

What is OS command injection? OS Command injection is a web application vulnerability, which allows the attacker to send a malicious OS command to take full control of the server or the infrastructure. Why OS Command injection is dangerous? Using OS command injection, the attacker may not only controls the server or the underlying infrastructure but there are highly likely chances…

What’s a DoS Attack? — A DoS attack (literally Denial of Service) is an attack, usually performed illegally, the purpose of which is to saturate the resources of a service or system by flooding it with requests until the resources are exhausted or by exploiting software bugs. …

Objective: Understanding Cross-Site Request Forgery (CSRF) and Its Implementation. Introduction: In today’s interconnected web landscape, security threats are a persistent concern for businesses and individuals. Cross-Site Request Forgery (CSRF) is one such vulnerability that poses a significant risk to web applications. In this article, we will explore what CSRF is…

https://tryhackme.com/room/valleype Introduction Welcome to another writeup! This time, we have a cool easy (not so easy) challenge, involving a lot of enumeration, interaction with FTP, network packets analysis, binary analysis, hash cracking and python library hijacking leading to privilege escalation! Nmap As always, we start by running Nmap to discover the available…

The first time I exploited a vulnerability was by using the Metasploit framework, and it was awesome! Using Metasploit was basically my first experience at penetration testing. In this article, I will be going over what tools I used, what steps I took and how I exploited a vulnerability. What…

Bagel is a recently retired Medium level machine. It involves exploiting an LFI vulnerability in the webapp to enumerate running processes, finding how the webapp communicates to a dotnet .dll file, inspecting its code to find and conduct an insecure deserialization attack to leak a user’s SSH key. From there…

apprehensive uneasiness or nervousness usually over an impending or anticipated ill : a state of being anxious (Merriam Webster) It starts with the little thumping of your heart and graduates to recurring frenzy and palpitations. Anxiety is the child of worry, and it cripples. Now it’s okay to have doubts…

Before Starting: Passwords are meant to be easy to bruteforce. Exercise Objective: “Your goal is to get the administrator’s password by brute forcing.” Similar to Ex.1, I will use the same “seclists” to attempt and find the admin user’s password, but this time I used the Hydra tool. I opened…