Show more

Day43: Read chapters 11 & 12 of _Bug Bounty Bootcamp_. Tomorrow is travel day.

Day45: Baseball Hall of Fame visited today and Chapter 14 of _Bug Bounty Bootcamp_ done. Going to need to do some more labs and walkthroughs of deserialization. Feels a bit like a dark art.

Day46: “Home again, home again, jiggity jig.” Rock and Roll Hall of Fame and chapter 15 of _Bug Bounty Bootcamp_ done. Enjoying a jigger of Canadian whiskey to unwind.

Day48: Mixed it up today. Started watching youtube.com/watch?v=Llw2PAlXUo, which led to a twitter/@Alh4zr3d livestream on twitch.tv/alh4zr3d, which then led me to twitter/@mttaggart and led me to youtube.com/taggarttech which has an API hacking video I want to watch next.

Day49: Read chapters 17 and 18 of _Bug Bounty Bootcamp_.

Day50: Watched some more of a stream with alh4zred. Shadowed someone on discord while they hacked on an android app. Got to see similarities between web apps and mobile apps. Also got to point out a ZAP feature, so I contributed a little bit! ;)

Day51: Flippin' power outage. It's back on and the day isn't done. I've been enumerating htb/trick. Once service appears to be a dead end. Another service is not giving anything up easily. A third service is interesting, I'm not as well versed in its tech. Fortunately, there's metasploit for that. For now, anyways.

Day52: Kept at htb/trick. Had to spend some time getting acquainted with how "Break" works in ZAP. Wanted to edit a page coming from the server. Didn't get the result I was hoping for. Got one more setting to try before ruling this approach out.

Day52.1: Went to the forums for some hints. Revisited a service I thought was a dead end. Double-checked syntax and tried another potential configurable. Boom. Found another entry point. Now I'm starting to get some progress. ...and I'm leaving to go to a concert soon. Gotta unplug for a bit, every now and again!

Day53: Got creds from yesterday's scans. Explored the app, looking for escalation vector. Found limited LFI, so progress!

Day54: Read another chapter, chapter 19, of _Bug Bounty Bootcamp_.

Day55: More banging on trick.htb. Found a new potential entry point. Took a while to figure out how to find it, but didn't get terribly far on it before I had to pack it in.

Day56: More cracking at trick.htb. Found a thing on an entry point, but I'm stuck turning it into something more useful. Tantalizing config on entry point two, but it isn't giving me any goods.

Day57: watched a live stream, Alh4zr3d breaks two k8s challenges on try hack me

Day58: Read chapter 21 in _Bug Bounty Bootcamp_. Dangling CNAME is bad, m'kay? A deeper dive on sign-sign-on exploits is really going to be needed for effectiveness.

Day59: Turns out I read chapter 20 yesterday and chapter 21 tonight. Duh. Saw a walk through yesterday that leveraged looking for .git on a web page. I haven’t done an analysis on that kind of information disclosure vuln, but I reckon it’s rare but damaging. Tomorrow, we read code.

Day61: Finished _Bug Bounty Bootcamp_, skipped chapter 23 and read chapters 24 & 25. Tomorrow, back to .

Day62: Okay, I lied. Not HtB. Looked at an Offensive Security Proving Grounds-Playground box. Watched a live walk-through on the box. Also watched an Ippsec video re: LFI.

Day63: Hack the Box Academy today. Worked on LFI module.

Day64: Started a multiday CTF. Got three of the first five challenges presented and am sitting on 800/1000 points. Going to sit in on Alh4zr3d stream before making dinner and watching the Jan6 shennanigans.

Day65: Looked at the CTF again. No new challenges. Did more enum on one of the remaining, but didn't make progress. Hit Offsec Proving Grounds Play and pwned "Dawn", so that helped recover some ego.

Day66: Took a quick look at an Offsec Proving Grounds Play box. Found an LFI. Have a couple of users. Didn't find anything else terribly fun. Making a run at brute forcing a password.

Day68: More work on Hack the Box Academy and on the ffuf module. Not making it through it as fast as I would like. Practice make perfect!

Day69: More work on HtB Academy & ffuf. One more exercise to complete. Also kibbutzed on Al4zr3d stream while he walked through a couple of TryHackMe boxes.

Day70: More work on HtB Academy & ffuf. Made some progress and then stalled. Looks like word list choice is finicky. Read this article and found it pretty interesting: blog.includesecurity.com/2022/. Signed up for the beta of git CodeSearch.

Day71: almost forgot to log it. Watched a stream. Hacked on a ctf. Figured out limited rce, but stumped on turning it into something really useful. It’ll be on tomorrow, so maybe a fresh look after sleep and coffee.

Day72: Continued banging on ctf. Limited rce was sneaky rabbit hole. Found correct path to get shell. New one on me, so that was fun. Working on pivot point. This one's a little tougher.

Day72.1: Update. I eventually figured the pivot—“pcap, or it didn’t happen!” Learned a bit more about Docker and worked on Wireshark skill. Ended up w/in top 10 and got a cyberrange voucher from the prize pool. I reckon there were between 50 and 100 people taking a crack at it.

Day73: Took a crack at today's release on HtB. Bunch of enumeration. Still poking around to find entry point. Not a webserver and I'm out of practice on anything but web servers, so this is good. Slow. But good.

Day74: Found a user w/low priv on the HtB box--based on the hostname, I took a flyer at a username I thought would match. Was able to use it to enumerate some additional users. Now brute-forcing for passwords. No school like the old school. Really wish folks would use fasttrack.txt for password brute forcing. Fairly long list of users, so this will take a while.

Day75: Got my CTF prize, a month-long access to Offsec Proving Grounds Practice, so started on that. Hitting the first easy box. Basic enumeration in-flight. SSH, DNS, and two web services and and two mqueue listeners.

Day76: Listened in on a couple of twitch streams by Alh4zr3d and mmtaggart. Poked at a Winderz box on offsec proving grounds.

Day77: I finished last night's target on Offsec PG Practice. Started in on a new one today. Bluekeep is a spooky vuln. Should be done w/that one soon.

Day78: Went along with the Alh4zr3d stream on a PG Play box. Rated as hard. Got a bead on the foothold. Slowing down to make some notes. Make brain wrinkles and have something to come back to in the future--tags, MF!

Follow

Day 79: Didn’t make time to get hands on keyboard today. Started _Web Application Hacker's Handbook_ and got through first two chapters. While it’s 11 years old, still seems pretty relevant.

Day80: Read ch 3 of _Web Application Hacker’s Handbook_. (fixed unfortunate typo)

Day81: Started Practical Web Application Security and Testing class from mttaggart

Day83: Hands on keyboard today! Worked on a pair of TryHackMe boxes. One down pretty quickly. Some progress on the second. Using msfconsole and msfvenom on that one. Issue w/getting handler and payload to match. Don't use it a whole lot, so more googling than I like.

Day83.1 Update: Finished 2nd box. Reset box and switched to meterpreter shell instead of trying to use command shell. Worked great.

Day84: Poked at a box on another platform. Looks like BlueKeep is the way in, but metasploit module is for x64 and the target is x86. Found a PoC for x86, but I'm fighting python module dependencies. I need to get better at venv, I guess. Then the clock ran out, so I can't pick at it until tomorrow.

Day85: Banged on academy.htb. Wordlists matter. Grr.

Day85: D’oh. Forgot to record yesterday. Worked on HtB Blackfield. I’m really liking CrackMapExec. Refreshed the Impacket brain wrinkles.

Day86: spent day off and on working on getting parrot and kali 2023 on hyper-v. Not an awesome experience.

Day87: Revisited Ubuntu Multipass and toolbox to run impacket, etc. from. Poked at academy.htb

Day89: Took a crack at an Offsec Proving Grounds box. Learned more how to deal with open proxies. (Wish I'd known how to do this a couple of years ago.)

Day90: Took a crack at Hack the Box machine return. I love evil-winrm. Got user pretty quick. Working on priv esc. Should put it away tonight.

Day91: Kept banging on 'return' off and on through the day. Some guidance, based on the results of whoami with priv flag, didn't work as expected. Spun up neo4j and bolt on my infra box for BloodHound. Listened in on mtaggart stream and learned a bit about Content-Security-Policy.

Day92: Today was not as productive as the past two. Did get in some time on alh4zr3d’s stream as he worked on a Try Hack Me box. Couple of tools referenced there look interesting.

Day93: No hands on keyboard hacking today. Read up on Active Directory to refresh and rebuild mental model of what it looks like on a network.

Day94: Forgot to log yesterday’s activity. Worked on HtB Health with some folks. Worked on python scripting skills.

Day95: Finished of HtB Health. Glad to have worked with a team. For an "easy" box, that felt far from it. Now to watch some web app hacking videos.

Day96: More watching Practical Web Application Security and Testing from academy.tcm-sec.com. Might poke at another HtB box before day is done.

Day97: Found alkanesollutions.co.uk/2021/02/26/list-ad-sites-and-subnets-using-powershell today. Very nice. Last time I poked at AD w/powershell I used the activedirectory module. Thought it was required. This doesn’t need that. Gonna refactor to output in a format more to my preference. Good place to start when mapping a network, ya?

Day98: More time on Practical Web Application Security and testing. Another section down.

Show more
Sign in to participate in the conversation

CounterSocial is the first Social Network Platform to take a zero-tolerance stance to hostile nations, bot accounts and trolls who are weaponizing OUR social media platforms and freedoms to engage in influence operations against us. And we're here to counter it.