Day 1: Enumerate targets in a web application CTF. Explore potential sqli points. Look at SSTI for Werkzeug. Look at SSRF candidate. (dafuq is a gunicorn?)

Day 2: Listened to @jhaddix@twitter talk about his methodology at NahamCon. Lot of good tools and some advice on things to pay attention to during enumeration. Need to re-watch and take notes--play with some tools. (Also was up to wee hours this a.m. working NahamCon ctf)

Day 3: Reviewed shub's (@infosec_au@twitter) slides (drive.google.com/file/d/14OFU-) from NahamCon 2022 re: Finding 0days in Enterprise Software. I did not know Lotus Domino was still a thing.

Day 4: Installed k8s on Ubuntu lab box. Downloaded Kubernetes Goat (madhuakula.com/kubernetes-goat) to install later tonight or tomorrow. I wish to grok the networking better.

Day 5: Virtually attended SANS CloudSecNext Summit. Really good Keynote by Sounil Yu (youtu.be/mEGqC1tuO4E). Also saw a preso on K8 security by Jay Beale.

I fell down and broke the chain. Watched Nahamsec's Live Recon Sundays session today with Stök and JHaddix where they interviewed @lilc. That was fun and a good reminder to get back at it. Got run some errands and then back at it tonight.

Day1a: New Chain. (Oof.) Today, started a multi-day by cmd+ctrl. Currently at 1570 points. Found a couple of pages susceptible to , which led to and sensitive data disclosure. Solved an encryption challenge and found a "published" DOS bug. Currently banging on an . ;)

Day2a: Continued . Solved crypto challenge and found hidden end point. Sqlmap continues chewing on user table. Used an idor and a script to enumerate all the users.

Day3a: Continued . Solved an image forensics channel. Wrote some scripts to reap user account data and to reap all the images. Read part one of a three part blog on bulbs found in a CDN provider network. CDN Provider had their side published, as well.

Day4a: Continued . Poked at login page and got an interesting error. Still tinkering with that between meetings. There's an auth bypass here, I can *smell* it. Also had some vigorous discussion on what Domain Isolation" is and isn't.

Day5a: Continued , but haven't gotten much further. Watched Hack the Box's "Hands on Hacking" live-stream that's setting up Cyber Apocalypse CTF 2022, which starts tomorrow. Keep an eye on HtB's youtube channel, they'll be posting the videos. The ippsec interview was good and Sheeraz gave a good overview of K8s, which I found helpful. (One more meeting and then I can focus on the auth bypass sqli...)

Day6: The new chain is longer than the old chain! Started Cyber Apocalypse CTF 2022 this morning and worked on it for a couple of hours. Got the 'intro' flag. Worked on two of the challenges, but haven't gotten anywhere--oof. Slight blow to psyche. Good weather today, so worked on container gardening. Now that dinner is done and have whisky on the side table, getting back at it.

Day7: Continued banging on Cyber Apocalypse CTF '22. Finally "really" on the board with a solved web challenge. Downloaded the code for a bunch of other challenges, so it's time to practice code analysis.

Day8: Continued Cyber Apocalypse CTF. Getting *way* more acquainted w/JavaScript. I've got an XSS, but I'm still working out weaponization. Still no additional points, but the day ain't done yet.

Day9: Continued Cyber Apocalypse . Moved to a new challenge. Enumerated site, but not finding entry point. Spent good part of day working on groking MSFT Defender for Cloud Apps.

Day 1b: Dropped the ball yesterday, busy day. Cyber Apocalypse is done. Working on a machine today. New day, new chain.

Day 2b: Kept at the machine. Working out a good payload. Interesting injection point. Also reworking note taking process. Still slow.

Day 3b: More reading about , still need to find right payload. Found an article that walks through a process to find a way to the OS module.

Day4b: Testing payloads. Trying to figure out if I’m overthinking it. Tokens matter.

Day6b: Hack the Box Academy. I like the UI for Burp, but I like not having to pay to get the goodness that ZAP brings. Also took a minute to break the rust off for using Metasploit. Can't remember the last time I looked at that.

Day7b: Read the Verizon DBIR. Interesting graphs in there. Nothing really new under the sun. Which isn't a bad thing.

Day8b: Power went out for a couple of hours today. So, went analogue and read two chapters of Hacking APIs by Corey J. Ball (nostarch.com/hacking-apis)

Day9b: Decided "hacking" myself counts today. Started using LYT (linkingyourthinking.com) note-taking. Moved a bunch of notes from old program to the new.

Day10: New chain, longer than the old chain! Read more of Hacking APIs, by Corey Ball. Looking forward to learning more about GraphQL—want to understand the AuthZ patterns and techniques. Also learned about Broken Object Level Authorization (BOLA). The examples look a lot like IDOR, but I think I grok the diff. You can have an IDOR that’s not a BOLA, but I reckon you could get a BOLA as a result of an IDOR. Still need to think and tinker with this one a bit.

Day11: Continued working on Hacking APIs. Next up is working on the labs. Created a postman account.

Follow

@ketchup9080 Thanks! I’ll check the site out.

@scottlink hack the box has modules in the academy program, there is API module

@ketchup9080 Thx for pointer. Unlocked and in the queue!

Sign in to participate in the conversation

CounterSocial is the first Social Network Platform to take a zero-tolerance stance to hostile nations, bot accounts and trolls who are weaponizing OUR social media platforms and freedoms to engage in influence operations against us. And we're here to counter it.