I suddenly noticed when visiting Try Hack Me that a new machine was published: Archangel. There were only a handful of people who had already cleared it, so I decided to have a go. Managed to hit the top 10 scoreboard! You can find the room here: https://tryhackme.com/room/archangel Getting a…
exploit
When I first started getting into the infosec game – I learnt most of my skills from VulnHub. VulnHub is an excellent platform for learning penetration testing; whether you are new to infosec or experienced. In this article, a writeup of the machine Photographer is provided. The developer left a…
Insecure Direct Object Reference (IDOR) vulnerabilities are still in the wild and could lead to, for example, horizontal privilege escalation. A user could modify certain values in a web application and gain access to unauthorised data. Developing a vulnerable application Moreover, the vulnerable web application was developed using Python with…
Buffer overflows are still found in various applications. The Exploit Database shows 48 buffer overflow related exploits published so far this year (July 2020). They are still highly visible. However, modern operating systems have made it tremendously more difficult to execute these types of attacks. Countermeasures such as DEP and…
In March 2018, a new Drupal core vulnerability (later named Drupalgeddon2) was discovered and marked as Highly Critical by the Drupal team. The vulnerability affected versions < 8.3.9 / < 8.4.6 / < 8.5.1. This article covers how the vulnerability can be manually exploited using Burp Suite. Further details regarding…