Infosec News, BugBounty POC, CTF Writeup, Security Advisories, Approach for Bug Bounty

Hackfest2016: Sedna - VM Vulnhub.com Sedna Vulnhub Machine Walkthrough This is a vulnerable machine its created for the Hackfest 2016 CTF http://hackfest.ca/ Difficulty : Medium Lets Start This VM very kindly has the IP address already showing when you fire it up so I can skip the netdiscover , arp-scan and head straight to the NMAP scan to see what the VM has to offer. Command : nmap -A 192.168.0.133 Nmap Results I’ll make a note of all of them and (as usual) with these VM’s lets jump straight into the 80 http port and see what the website has to offer. I’ll just run a nikto scan before heading over to the webiste, the output (if any) should make our reviewing more efficient. Nikto findings (Interesting Results) Cool, so it shows there’s a robots.txt file. Lets fire up firefox and take a look at the site and that robots.txt file. Robots.txt file results The robots file didn’t have anything ...

  Vulnhub .com — Quaoar VM Walkthrough     Three Different Techniques to exploit a machine Vulnhub Machine This VM was made for hack fest 2016 and is listed as very easy. I had this one done in under an two hour with three different Techniques. Description Welcome to Quaoar This is a vulnerable machine which is created for http://hackfest.ca/ Difficulty  : Very Easy Tips: Here are the tools you can research to help you to own this machine. nmap, dirb / dirbuster / BurpSmartBuster, nikto, wpscan, hydra Your Brain Coffee Google :) Goals: This machine is intended to be doable by someone who is interested in learning computer security There are 3 flags on this machine 1. Get a shell 2. Get root access 3. There is a post exploitation flag on the box     Different Techniques to Exploit : Reverse Shell Plugin Upload Metasploit Wordpress Exploit Payload Payload post in 404 page So St...