What is The Internet? Earlier today, my sister entered the living room. She opened Spotify on her phone and started to play As It Was, by Harry Styles. Despite standing in Athens, thousands of miles away from Spotify’s headquarters in Stockholm, the song began to play almost instantaneously. How on Earth did this happen? The…
Let’s continue on from Part 1. We’ll be covering these techniques: Use this virtual machine to execute the techniques (it’s the same machine from Part I.) SUID SUID with PATH Environment Variable (Indirect) Let’s start with this question: How does the Linux terminal find an executable file that we execute as a command? For example,…
Privilege escalation is a key part of pentesting. Imagine a Linux system with three users: Asher, Cyber, and Root. Each has a different permission set. Asher can access and modify all the files he owns. Because the system administrator put him in the sudo group, he can access root permission. He may need to authenticate…
Buckle up! In this lesson, we’ll use BurpSuite to conduct a privilege escalation attack. We’ll hack into a machine provided by TryHackMe. This is one of my favorite companies for learning CyberSecurity. They have incredible resources for free (and 100% legal) hacking! Make sure you’ve completed the BurpSuite Part I and Part II introductory posts…
Let’s continue from Part I. We covered the Dashboard, Proxy, and Repeater sections in that lesson. Time to cover the Intruder section: Intruder The Intruder is fundamentally a fuzzing tool. It sends multiple requests with altered values to a target. There are 4 tabs within the Intruder: Positions, Payloads, Resource Pool, and Settings Positions This…
This post will cover BurpSuite, the most popular VAPT (Vulnerability Assessment and Penetration Testing) tool for web applications. You can use this tool to intercept web requests and responses, including HTTPS, and modify them in real-time to find vulnerabilities in web apps. We’ll install it onto our Kali box and cover the basics. By the…
Hello! I hope you did your homework in the Introduction to Suricata lesson. If you have not completed that yet, don’t continue with this post until you have! We’ll be dissecting the Suricata YAML file today. Suricata has endless features, but the real power for a Cybersecurity professional comes from configuring it to best suit…