Hi hackersLet’s start Let’s begin in nmap, as we always do. Rcon nmap shows two open ports, http (TCP 80) and ssh (TCP 22): I can’t find anything on the page, so I decide to read the page source code and find the new page in source code image.late.htb add etc/hosts 10.10.11.156 images.late.htb as discovered by SSTI injection vulnerability Referncehttps://ajinabraham.com/blog/server-side-template-injection-in-tornadohttps://github.com/carlospolop/hacktricks/blob/master/pentesting-web/ssti-server-side-template-injection/README.mdhttps://medium.com/@nyomanpradipta120/ssti-in-flask-jinja2-20b068fdaeee ...

Hello hackers Windows is used by this computer. Because I have little familiarity with Windows boxes and spend the majority of my practise time on the Linux command line, I found this machine to be challenging (but worthwhile). But this box is ideal if you want to learn something interesting about Windows. Let’s get started #Recon: We first start with ...

HTB-TimeLapse machine is really a great learning box for those who are new to Windows and Active Directory Pentesting I found the initial access (user flag) easier and root flag was a bit tricky for me due to my lack of windows privilege escalation skills overall its a fun machine Enumeration As always starting with an Nmap scan Nmap discovery ...

https://app.hackthebox.eu/machines/359 BountryHunter is web based easy difficulty machine . Table of contents Scanning Nmap Enumaration Gobuster Exploitation Burpsuite and SSH Privilege Escalation ticketValidator.py Scanning ( In this face I want to do the OS Discovery, Open ports, Services on open ports and also the vulnerability scripts checking too.) For scanning purposes I choose Nmap. Nmap is the default in all Debian ...

Tabby is an easy Linux based machine from Hackthebox. The initial foothold to this box is obtained by Tomcat Manager app exploit and an LFI. Gaining user access requires a decent amount of enumeration. Root access obtained by exploiting the LXC. In this blog I have tried to separate each process Enumeration 2. Initial foothold 3. Lateral movement 4. Privilage ...

From the quick nmap scan I saw that two ports were open SSH and http By browsing into the port 80, I get to know that litecart is during by running gobuster I found /backup directory From there I got a tar file. I downloaded it my local machine From the file at shop/admin/login.php from the tar file I got ...

Started with nmap scan nmap –sS –sV –T4 10.10.10.200 First I tried access the http port but nothing was rendering there. The port 873 is enabled here,rsync is a utility for efficiently transferring and synchronizing files between a computer and an external hard drive and across networked computers by comparing the modification times and sizes of files(souce google.com) rsync -v ...