BurpSuite Archives - Page 3 of 16

2 Aug, 2025

Hack The Box: Code Machine Walkthrough – Easy Difficulity

Easy Machine BurpSuite, Challenges, HackTheBox, hashtag, json, Linux, Penetration Testing, python3, sqliite3, ssh

Successfully exploited a code execution vulnerability in a web application by bypassing keyword restrictions through Python class enumeration, leading to a reverse shell as the app-production user and retrieval of the user.txt flag. Leveraged access to a SQLite database to crack credentials for the martin user and escalate privileges. Identified a backup script running with root privileges, crafted a malicious JSON payload to include the root directory in backups, and ultimately obtained the root.txt flag.

This engagement highlights the importance of secure input validation, credential management, and careful privilege delegation in application security.

#Cybersecurity #HackTheBox #CTF #PenetrationTesting #PrivilegeEscalation #ApplicationSecurity …

Learn MoreHack The Box: Code Machine Walkthrough – Easy Difficulity

26 Jul, 2025

Hack The Box: Cypher Machine Walkthrough – Medium Difficultyy

Medium Machine bbot, BurpSuite, Challenges, Cypher Injection, gobuster, HackTheBox, jadx-gui, jar, Linux, neo4j, Penetration Testing, python3

12 Jul, 2025

Hack The Box: Dog Machine Walkthrough (Easy Difficulty)

Easy Machine Backdrop, bee, BurpSuite, Challenges, command injection, CVE-2024-41709, git-dumper, HackTheBox, Linux, Penetration Testing, PHP, pwncat-cs, reverse shell

5 Jul, 2025

Hack The Box: Cat Machine Walkthrough – Medium Diffculity

Medium Machine BurpSuite, Challenges, command injection, Cross Site Scripting, git-dumper, Gitea, gobuster, HackTheBox, hashcat, Linux, Penetration Testing, port forwarding, source code review, SQL, SQL Injection, sqlite3, ssh

Hack The Box Success: Cat Machine Write-Up Published!

I’ve just published my personal write-up for the Cat machine on Hack The Box. In this challenge, I gained the user flag by exploiting a Stored XSS vulnerability to capture the admin session cookie, followed by an SQL Injection to extract credentials and gain SSH access. For the root flag, I took advantage of a vulnerable image processing script owned by root, crafting a payload to gain a root shell and retrieve the flag. The full write-up dives into each step, the logic behind the attacks, and key takeaways.

#CyberSecurity #HackTheBox #PenetrationTesting #EthicalHacking #CTF #WriteUp #XSS #SQLi #PrivilegeEscalation #InfoSec #CTFWriteup …

Learn MoreHack The Box: Cat Machine Walkthrough – Medium Diffculity

21 Jun, 2025

Hack The Box: Titanic Machine Walkthrough – Easy Difficulty

Easy Machine BurpSuite, Challenges, CVE-2024-41817, directory traversal, HackTheBox, ImageMagick, Linux, Penetration Testing, python3, ssh

Just wrapped up a detailed walkthrough of the Hack The Box Titanic machine — an easy-rated challenge packed with valuable learning opportunities!

The journey started with exploiting a directory traversal vulnerability to access sensitive Gitea configuration files and extract user credentials. From there, I gained SSH access as the developer user and retrieved the user flag.

Privilege escalation was achieved by exploiting a critical ImageMagick vulnerability (CVE-2024-41817) in a writable directory, allowing arbitrary code execution via a crafted shared library. I also discovered the developer user had unrestricted sudo privileges, providing a straightforward path to root.

#HackTheBox #CyberSecurity #Pentesting #CTF #PrivilegeEscalation #LinuxSecurity #ImageMagick #CVE202441817 #EthicalHacking #DirectoryTraversal

…

Learn MoreHack The Box: Titanic Machine Walkthrough – Easy Difficulty

14 Jun, 2025

Hack The Box: Inflitrator Machine Walkthrough – Insane Difficulity

Insane Machine bitlocker, Bloodhound, BloodHoundCE, bloodyAD, BurpSuite, Certipy, Challenges, evil-winrm, HackTheBox, hashcat, impacket, john the ripper, kerbrute, Output Messenger, Penetration Testing, RDP, sqlite3, Windows, Wireshark

Successfully completed a two-stage Active Directory exploitation scenario involving both user access and privilege escalation. The first stage focused on identifying accounts that did not require Kerberos pre-authentication (AS-REP Roasting), allowing extraction and cracking of a user password hash to gain remote access and retrieve the user flag. In the second stage, a misconfigured certificate template (ESC4 vulnerability) within Active Directory Certificate Services was exploited to request a certificate impersonating a privileged user. This enabled full administrative access and retrieval of the root flag.

#CyberSecurity #ActiveDirectory #RedTeam #Kerberos #PrivilegeEscalation #ASREP #ADCS #ESC4 #PenetrationTesting #Infosec #HackTheBox #WindowsSecurity #CTF
Successfully completed a two-stage Active Directory exploitation scenario involving both user access and privilege escalation. The first stage focused on identifying accounts that did not require Kerberos pre-authentication (AS-REP Roasting), allowing extraction and cracking of a user password hash to gain remote access and retrieve the user flag. In the second stage, a misconfigured certificate template (ESC4 vulnerability) within Active Directory Certificate Services was exploited to request a certificate impersonating a privileged user. This enabled full administrative access and retrieval of the root flag.

#CyberSecurity #ActiveDirectory #RedTeam #Kerberos #PrivilegeEscalation #ASREP #ADCS #ESC4 #PenetrationTesting #Infosec #HackTheBox #WindowsSecurity #CTF
…

Learn MoreHack The Box: Inflitrator Machine Walkthrough – Insane Difficulity

31 May, 2025

Hack The Box: Checker Machine Walkthrough – Hard Difficulty

Hard Machine BookStack, BurpSuite, Challenges, CVE-2023-1545, CVE-2023-6199, gobuster, HackTheBox, Linux, OTP, Penetration Testing, python3, ssh, Teampass

Successfully exploited CVE-2023-1545 in Teampass to extract user credentials and leveraged CVE-2023-6199 in BookStack to obtain an OTP, gaining user-level access on the Checker machine. Privilege escalation was achieved by exploiting a sudo script interacting with shared memory, setting the SUID bit on /bin/bash to capture the root flag. A great example of combining application vulnerabilities with creative privilege escalation techniques!

#Cybersecurity #EthicalHacking #HackTheBox #PenetrationTesting #InfoSec #VulnerabilityResearch #PrivilegeEscalation #CTF #SecurityResearch …

Learn MoreHack The Box: Checker Machine Walkthrough – Hard Difficulty

17 May, 2025

Hack The Box: Heal Machine Walkthrough – Medium Difficulty

Medium Machine BurpSuite, Challenges, consul, HackTheBox, hashcat, jwt, LimeSurvey, Linux, Path Traversal, Penetration Testing, port forwarding, rails, ruby, sqlite3, ssh

Writeup Summary: Heal (Hack The Box)

This box involved thorough enumeration that uncovered multiple subdomains, including a Ruby on Rails API. Initial access was gained by chaining a Local File Inclusion vulnerability with password cracking and exploiting a LimeSurvey plugin upload vulnerability. Privilege escalation was achieved by identifying and exploiting an exposed Consul service accessible through SSH port forwarding.

This challenge showcased key red teaming skills: web application exploitation, misconfiguration abuse, credential harvesting, and lateral movement.

#HackTheBox #CyberSecurity #RedTeam #PrivilegeEscalation #BugBounty #WebSecurity #Infosec #CTF #HTB #OffensiveSecurity #LinuxExploitation …

Learn MoreHack The Box: Heal Machine Walkthrough – Medium Difficulty

3 May, 2025

HackTheBox – BigBang Machine Walkthrough (Hard Difficulty)

Hard Machine Android, BuddyForms, BurpSuite, Challenges, chisel, CVE-2023-26326, CVE-2024-2961, file upload, gobuster, grafana, grafana2hashcat, HackTheBox, hashcat, Linux, Local File Inclusion (LFI), MySQL, Penetration Testing, port forwarding, python3, Remote Code Execution (RCE) in WordPress, Server Misconfigurations, Wordpress

Chained exploitation through misconfigured web app and internal services. We started by exploiting a WordPress plugin vulnerability (CVE-2023-26326) to upload files, followed by a file read vulnerability (CVE-2024-2961) for remote code execution. From there, we cracked the database credentials, gained SSH access as the shawking user, and leveraged a vulnerable API endpoint to escalate to root. This highlights how overlooked configurations and service misconfigurations can lead to a full server compromise.

#CTF #PrivilegeEscalation #WebSecurity #CommandInjection #SSH #WordPress #LinuxPentesting #BugBounty #HackTheBox #RedTeam #CyberSecurity …

Learn MoreHackTheBox – BigBang Machine Walkthrough (Hard Difficulty)

12 Apr, 2025

Hack The Box: LinkVortex Machine Walkthrough Easy Difficulty

Easy Machine BurpSuite, Challenges, CVE-2023-40028, GhostCMS, GitDumper, HackTheBox, Linux, Local File Inclusion, Penetration Testing, ssh, SudoMisconfiguration

Successfully demonstrated advanced cybersecurity skills by exploiting a Ghost CMS vulnerability (CVE-2023-40028) to access sensitive credentials and secure the user flag. Identified and leveraged a sudo misconfiguration with the CHECK_CONTENT variable to escalate privileges and retrieve the root flag from /root/root.txt. Thrived in this hands-on challenge, sharpening penetration testing expertise! #HackTheBox #Cybersecurity #EthicalHacking #PenetrationTesting #CTF …

Learn MoreHack The Box: LinkVortex Machine Walkthrough Easy Difficulty

Threatninja.net

Threatninja.net

Hack The Box: Code Machine Walkthrough – Easy Difficulity

Hack The Box: Cypher Machine Walkthrough – Medium Difficultyy

Hack The Box: Dog Machine Walkthrough (Easy Difficulty)

Hack The Box: Cat Machine Walkthrough – Medium Diffculity

Hack The Box: Titanic Machine Walkthrough – Easy Difficulty

Hack The Box: Inflitrator Machine Walkthrough – Insane Difficulity

Hack The Box: Checker Machine Walkthrough – Hard Difficulty

Hack The Box: Heal Machine Walkthrough – Medium Difficulty

HackTheBox – BigBang Machine Walkthrough (Hard Difficulty)

Hack The Box: LinkVortex Machine Walkthrough Easy Difficulty

Threatninja.net

Threatninja.net

Tag Archives: BurpSuite