Blog & Insights

Pre-Foothold All port nmap Deep scan Visit the webpage and find this According to the staff listing we have a sysadmin which means a potential login username. Also Our friend...

found directory /tiny from go buster File manager access success! Default creds admin/admin@123 Found a vuln based on the version number in the bottom right. You can also get it...

Tried an all port scan but it was taking a REALLY long time, so I went straight for a deep scan. Tried visiting the standard 80 port but with it...

Pre-Foothold Ok! My previous walkthroughs were based on machines from the Proving Grounds by OffSec. This one will be my first from Hack-The-Box, also known as htb! Starting with an...

Pre-Foothold All port Deep_Scan Tried to visit the page and didn’t get a response via browser. So I curled the page and included the header and found a host name....

Pre-Foothold Started with an all port scan and got this Deep scan brought back this. Interested to see what 50051 is tried visiting the port via web browser and got...

Pre- Foothold Initial All port scan Deep port Login to Cacti looks interesting. The version is a little behind here, lets see if we can find default creds, got nothing,...

I’ve done quite a few CTF challenges which often include modifying files in your preferred distro in order to simplify access or make things accessible. I’m talking about adding subdomains,...

Initial All Port scan. All port didnt bring much in. Moving to service enumeration Notice the disallowed entries. Let’s start there. I visited the first robots.txt link and got this...

Pre Foothold All port scan came back Deep Scan came back, anonymous login available. I’ll run a deep scan on that odd 3632 port as well 3632 Port. Something called...

Ok we’ve got another one of the seasonal machines here, lets get to it! Initial nmap scan scanning all ports only returns two, the common ones I come across Seeing...

All port Deep scan + redirect to cozyhosting.htb Found a login page, default creds did not work Inspecting the source leads to a template name and a bootstrap version Next...

Autorecon runs, I curl the headers for seperate ports. 9999 gives nothing 1111 shows info So does 5000. 5000 seems to be the most promising. I should say I got...

First nmap scan All we have is an open web port and an ssh port. Visited the page We have an idea of what is running based on what we...

Pre Foothold nmap scan is taking a long time so I curled the IP and included the header Updated the /etc/hosts file nmap still taking long. Decided to just try...