Technical Bandey

Now, SQLi to SHELL is one of the VM machine challenge to get shell of the server using SQLi. PENETRATION METHODOLOGY: NMAP SQLMAP METASPLOIT EXPLOITATION First of all, we need to enumerate the services and ports running on the server for the information gathering purpose of the target. As the result shows that the target is running ssh and http  services. Now check the HTTP for further information gathering. On visiting HTTP, it running a photoblog. On further enumeration, we get that the server is vulnerable to SQLi vulnerability. As we are able to run sqlmap on the server and try to find out the user details. On running sqlmap, we get the admin user and password. Trying to login with this credentials and we are successful to enter in the admin panel. Now try to upload our malicious php script and get a reverse tcp shell. We create the malicious payload using msfvenom with file extension as ' php3 ' because the server does ...

This is another VM named as Billu_B0x. This is very easy to access and can get root access of the machine. PENETRATION METHODOLOGY: NMAP DIRB CURL SSH EXPLOITATION First of all we need to run nmap to enumerate ports and services running on the server. On enumerating target, we get ssh and http are running. On viewing HTTP over browser, we get the following page running. Now trying to run ' dirb ' on the web server using the big.txt dictionary. On the scan we found phpmy page, we find phpmyadmin is running. After that viewing the dirb scan, their is '/test', by visiting the directory we found that page. This page shows that their is post parameter named 'file'. Now we are trying to curl this page using tool ' curl ' to read the remote files by using LFI vulnerability. First, we are trying to read the passwd file on the remote location. And we are success to read the file. Now we are trying the configu...

This is the another boot2root challenge based on the TV show mrRobot. This VM has three flags/keys on different locations and to find them all, exploit the machine remotely and get into root shell. PENETRATION METHODOLOGY: NMAP WPSCAN DIRB WGET METASPLOIT-FRAMEWORK NMAP INTERACTIVE MODE On service enumeration of the VM, we get multiple ports and services running. As this result shows that HTTP service is running is running and on visiting the IP over http we get following page On checking the robots.txt file, we get this page with two entries. As viewing the entries, one of the file is first key and another file is dictionary for passwords. Downloading both files. As now we run the ' dirb ' to find directories on the web. On the dirb result we found that the server is running wordpress. So we know that the Elliot is the main person of the show, so let's try his name for the wordpress login. Now try to crack this pass...

One of the questions that we often hear is "What systems can i use to test against?" Based on this, we thought it would be a good idea throw together an exploitable VM that you can use for testing purposes. Metasploitable is an Ubuntu 8.04 server install on a VMWare 6.5 image. A number of vulnerable packages are included, including an install of tomcat 5.5 (with weak credentials), distcc, tikiwiki, twiki, and an older mysql. You can use most VMware products to run it, and you'll want to make sure it's configured for Host-only networking unless it's in your lab - no need to throw another vulnerable machine on the corporate network. It's configured in non-persistent-disk mode, so you can simply reset it if you accidentally 'rm -rf' it. SERVICE ENUMERATION On service enumeration of the machine we get multiple ports open. EXPLOITATION This machine is vulnerable to a metasploit exploit which return a reverse shell with root user. e...