• Search for:

    Tag Archives: BurpSuite

    1. Home  - 
    2. Posts tagged "BurpSuite"
      3. ( Page2 )
    23 Aug, 2025
    Hack The Box: TheFrizz Machine Walkthrough – Medium Difficulity
    Medium Machine , , , , , , , , , , , , , , ,

    I successfully captured both user and root flags by exploiting a file upload vulnerability to gain a web shell, extracting database credentials from config.php, and cracking the user hash to reveal the password Jenni_Luvs_Magic23. Using these credentials, I accessed the web application, discovered an SSH migration hint, and leveraged a Kerberos ticket (f.frizzle.ccache) to gain SSH access and retrieve the user flag with type user.txt. For the root flag, I escalated privileges using M.SchoolBus and SharpGPOAbuse to manipulate SleepGPO, applied changes with gpupdate.exe /force, extracted credentials with secretdump, and used wmiexec to secure a root-level shell, ultimately reading the root flag with type root.txt.

    #Cybersecurity #CTF #EthicalHacking #PenetrationTesting …

    Learn MoreHack The Box: TheFrizz Machine Walkthrough – Medium Difficulity

    16 Aug, 2025
    Hack The Box: Nocturnal Machine Walkthrough – Easy Difficulty
    Easy Machine , , , , , , , , , , ,

    Captured the user flag by exploiting a file upload feature, unpacking .odt files to reveal a hidden password with xmllint, and injecting a reverse shell via the backup feature to get a www-data shell. Retrieved hashes from the nocturnal_database, cracked Tobias’s password (slowmotionapocalypse), and obtained the user flag. For the root flag, enumerated open ports, found port 8080 running ISPConfig, accessed it with admin credentials, identified the version, executed a public exploit, and gained root shell to capture the root flag.

    #HTB #HackTheBox #CyberSecurity #RedTeam #CTF #PenTesting #Nocturnal #LinuxExploitation #WebExploitation #PrivilegeEscalation …

    Learn MoreHack The Box: Nocturnal Machine Walkthrough – Easy Difficulty

    9 Aug, 2025
    Hack The Box: University Machine Walkthrough – Insane Walkthrough
    Insane Machine , , , , , , , , , , ,

    Compromised university.htb by exploiting ReportLab RCE (CVE-2023-33733) to gain initial access as wao. Forged a professor certificate to impersonate george, then uploaded a malicious lecture to compromise Martin.T.

    Escalated privileges by exploiting a scheduled task with a malicious .url file, used LocalPotato (CVE-2023-21746) for elevation on WS-3, and abused SeBackupPrivilege to extract NTDS.dit, ultimately retrieving Domain Admin credentials.

    🔍 A great hands-on challenge combining web exploitation, privilege escalation, and Active Directory abuse.

    #CyberSecurity #RedTeam #CTF #PrivilegeEscalation #HTB #InfoSec #WindowsExploitation #PenetrationTesting #EthicalHacking #HackTheBox …

    Learn MoreHack The Box: University Machine Walkthrough – Insane Walkthrough

    2 Aug, 2025
    Hack The Box: Code Machine Walkthrough – Easy Difficulity
    Easy Machine , , , , , , , , ,

    Successfully exploited a code execution vulnerability in a web application by bypassing keyword restrictions through Python class enumeration, leading to a reverse shell as the app-production user and retrieval of the user.txt flag. Leveraged access to a SQLite database to crack credentials for the martin user and escalate privileges. Identified a backup script running with root privileges, crafted a malicious JSON payload to include the root directory in backups, and ultimately obtained the root.txt flag.

    This engagement highlights the importance of secure input validation, credential management, and careful privilege delegation in application security.

    #Cybersecurity #HackTheBox #CTF #PenetrationTesting #PrivilegeEscalation #ApplicationSecurity …

    Learn MoreHack The Box: Code Machine Walkthrough – Easy Difficulity

    26 Jul, 2025
    Hack The Box: Cypher Machine Walkthrough – Medium Difficultyy
    Medium Machine , , , , , , , , , , ,

    Successfully exploited a vulnerable Neo4j database via Cypher injection to extract credentials, gain SSH access, and retrieve the user flag. Then leveraged a misconfigured `bbot` binary with sudo rights to set the SUID bit on `/bin/bash`, escalating privileges to root and capturing the root flag. #Cybersecurity #Neo4j #CypherInjection #PrivilegeEscalation #Pentesting #EthicalHacking #InfoSec …

    Learn MoreHack The Box: Cypher Machine Walkthrough – Medium Difficultyy

    12 Jul, 2025
    Hack The Box: Dog Machine Walkthrough (Easy Difficulty)
    Easy Machine , , , , , , , , , , , ,

    Exploited exposed credentials in a .git repository to access Backdrop CMS, then used a remote command execution vulnerability (EDB-ID: 52021) for a reverse shell. Escalated to root by leveraging a misconfigured bee binary with sudo privileges, capturing both user and root flags.

    #Cybersecurity #HackTheBox #PenetrationTesting #CTF #WebExploitation #PrivilegeEscalation #EthicalHacking #InfoSec #CyberSec #Hacking …

    Learn MoreHack The Box: Dog Machine Walkthrough (Easy Difficulty)

    5 Jul, 2025
    Hack The Box: Cat Machine Walkthrough – Medium Diffculity
    Medium Machine , , , , , , , , , , , , , , , ,

    Hack The Box Success: Cat Machine Write-Up Published!

    I’ve just published my personal write-up for the Cat machine on Hack The Box. In this challenge, I gained the user flag by exploiting a Stored XSS vulnerability to capture the admin session cookie, followed by an SQL Injection to extract credentials and gain SSH access. For the root flag, I took advantage of a vulnerable image processing script owned by root, crafting a payload to gain a root shell and retrieve the flag. The full write-up dives into each step, the logic behind the attacks, and key takeaways.

    #CyberSecurity #HackTheBox #PenetrationTesting #EthicalHacking #CTF #WriteUp #XSS #SQLi #PrivilegeEscalation #InfoSec #CTFWriteup …

    Learn MoreHack The Box: Cat Machine Walkthrough – Medium Diffculity

    21 Jun, 2025
    Hack The Box: Titanic Machine Walkthrough – Easy Difficulty
    Easy Machine , , , , , , , , ,

    Just wrapped up a detailed walkthrough of the Hack The Box Titanic machine — an easy-rated challenge packed with valuable learning opportunities!

    The journey started with exploiting a directory traversal vulnerability to access sensitive Gitea configuration files and extract user credentials. From there, I gained SSH access as the developer user and retrieved the user flag.

    Privilege escalation was achieved by exploiting a critical ImageMagick vulnerability (CVE-2024-41817) in a writable directory, allowing arbitrary code execution via a crafted shared library. I also discovered the developer user had unrestricted sudo privileges, providing a straightforward path to root.

    #HackTheBox #CyberSecurity #Pentesting #CTF #PrivilegeEscalation #LinuxSecurity #ImageMagick #CVE202441817 #EthicalHacking #DirectoryTraversal

    …

    Learn MoreHack The Box: Titanic Machine Walkthrough – Easy Difficulty

    14 Jun, 2025
    Hack The Box: Inflitrator Machine Walkthrough – Insane Difficulity
    Insane Machine , , , , , , , , , , , , , , , , , ,

    Successfully completed a two-stage Active Directory exploitation scenario involving both user access and privilege escalation. The first stage focused on identifying accounts that did not require Kerberos pre-authentication (AS-REP Roasting), allowing extraction and cracking of a user password hash to gain remote access and retrieve the user flag. In the second stage, a misconfigured certificate template (ESC4 vulnerability) within Active Directory Certificate Services was exploited to request a certificate impersonating a privileged user. This enabled full administrative access and retrieval of the root flag.

    #CyberSecurity #ActiveDirectory #RedTeam #Kerberos #PrivilegeEscalation #ASREP #ADCS #ESC4 #PenetrationTesting #Infosec #HackTheBox #WindowsSecurity #CTF
    Successfully completed a two-stage Active Directory exploitation scenario involving both user access and privilege escalation. The first stage focused on identifying accounts that did not require Kerberos pre-authentication (AS-REP Roasting), allowing extraction and cracking of a user password hash to gain remote access and retrieve the user flag. In the second stage, a misconfigured certificate template (ESC4 vulnerability) within Active Directory Certificate Services was exploited to request a certificate impersonating a privileged user. This enabled full administrative access and retrieval of the root flag.

    #CyberSecurity #ActiveDirectory #RedTeam #Kerberos #PrivilegeEscalation #ASREP #ADCS #ESC4 #PenetrationTesting #Infosec #HackTheBox #WindowsSecurity #CTF
    …

    Learn MoreHack The Box: Inflitrator Machine Walkthrough – Insane Difficulity

    31 May, 2025
    Hack The Box: Checker Machine Walkthrough – Hard Difficulty
    Hard Machine , , , , , , , , , , , ,

    Successfully exploited CVE-2023-1545 in Teampass to extract user credentials and leveraged CVE-2023-6199 in BookStack to obtain an OTP, gaining user-level access on the Checker machine. Privilege escalation was achieved by exploiting a sudo script interacting with shared memory, setting the SUID bit on /bin/bash to capture the root flag. A great example of combining application vulnerabilities with creative privilege escalation techniques!

    #Cybersecurity #EthicalHacking #HackTheBox #PenetrationTesting #InfoSec #VulnerabilityResearch #PrivilegeEscalation #CTF #SecurityResearch …

    Learn MoreHack The Box: Checker Machine Walkthrough – Hard Difficulty