Anonhack

"If Nobody sees it, it didn't Happen"

Category: CTF Challenges

  • Spookifier Hack The Box Walkthrough – SSTI Web Challenge

    Spookifier Hack The Box Walkthrough – SSTI Web Challenge

    This article is a walkthrough for the Spookifier Hack The Box web challenge. Spookifier is a Python-based web challenge that revolves around Server-Side Template Injection (SSTI). We will also talk about the multiple payloads for SSTI and mitigation of it.

  • DogCat – Exploiting LFI and Docker Privilege Escalation -TryHackMe Walkthrough

    DogCat – Exploiting LFI and Docker Privilege Escalation -TryHackMe Walkthrough

    In this walkthrough, we’ll explore the Dogcat room on TryHackMe, a box that features a Local File Inclusion (LFI) vulnerability and Docker privilege escalation. LFI allows us to read sensitive files from the system and eventually gain access to the server.There are a total of 4 flags in this machine which we need to find.…

  • OverPass – TryHackMe Walkthrough

    OverPass – TryHackMe Walkthrough

    A step-by-step TryHackMe Overpass walkthrough, guiding you through reconnaissance, web enumeration, SSH access, and privilege escalation to root.

  • Prime: 1 – Walkthrough for OSCP Series

    Prime: 1 – Walkthrough for OSCP Series

    Prime: 1 is a challenging boot2root machine created by Suraj Pandey. It is designed for those who are preparing for the OSCP exam and is a great way to practice your penetration testing skills. In this blog post, I will walk you through the steps I took to root the machine, including: Performing a port…

  • LazySysAdmin – Vulnhub walkthrough

    LazySysAdmin – Vulnhub walkthrough

    LazySysAdmin is an easy to crack VM. There are multiple ways to crack this machine, several ports and mis-configured services are present inside this box. The takeaway from this machine for me is to understand a service better and thinking simpler to get root privileges after we are able to exploit a badly configured service.…

  • digital world.local: Vengeance Walkthrough – OSCP Way

    digital world.local: Vengeance Walkthrough – OSCP Way

    Vengeance is one of the digital world.local series which makes vulnerable boxes closer to OSCP labs. This box has a lot of services and there could be multiple ways to exploit this, Below is what I have tried. Lab requirement: 1. Kali VM 2. Download Vengeance: https://www.vulnhub.com/entry/digitalworldlocal-vengeance,704 3. Some patience. I have written article already…

  • DC-9 Vulnhub Walkthrough – OSCP way

    DC-9 Vulnhub Walkthrough – OSCP way

    Recently, My focus turned more towards OSCP and I am thinking of taking the exam. After reading tons of people’s experience over Reddit, I took some notes on what would be my way of studying for this. It isn’t easy from the looks of it and to win with time, I need a lot of…

  • Empire: LupinOne Walkthrough – Privilege escalation through Python Libs

    Empire: LupinOne Walkthrough – Privilege escalation through Python Libs

    This article is a walkthrough for Empire LupinOne vulnerable machine. You can download this from vulnhub. The vulnerable machine is full of fuzzing and escalation of privileges by exploiting Python libraries with SUID being setup. Let’s look into exploiting this: Requirements: 1. Vmware/Virtual Box < This is to run the vulnerable machine. 2. Download LupinOne…

  • Pwned Vulnhub Walkthrough

    Pwned Vulnhub Walkthrough

    Pwned vulnhub challenge is an easy boot2root machine. One of the key take away from this machine is how you can escalate your privileges using Dockers. This blog post is about how I exploited this machine and what are the different tools I used to make that happen. Below are the requirements: You can get…

  • Insecure Code Management – Git

    Insecure Code Management – Git

    Insecure code management is when part of the code exposes sensitive information which shouldn’t be exposed to the world. Now it can happen in a lot of situation where the API keys/Passwords are hard-coded and it has been shared mistakenly by the developers. This article will cover the part of Git version control feature and…

  • Hacker101 CTF walkthrough Micro-CMS v1 and v2

    Hacker101 CTF walkthrough Micro-CMS v1 and v2

    Hacker101 CTF is based on Web, Crypto and Android platforms. The challenges are good for the beginners, some of the basics are covered through these CTF. I will be discussing “A little something to get you started”, “Micro-CMS v1” and “Micro-CMS v2” in this post. Check out my post on Bugcrowd’s CTF writeup here: https://anonhack.in/2020/08/bugcrowds-levelupctf-0x07-walkthrough/…

  • BugCrowd’s LevelupCTF 0x07 walkthrough

    BugCrowd’s LevelupCTF 0x07 walkthrough

    LevelupCTF is a seven flag CTF. It contains vulnerabilities from information disclosures to Remote Code execution. Each flag provides hints towards the next flag. The CTF consists of wide range of challenges which provides great learning as well. Below are the vulnerabilities and their impacts that I have found: Sensitive Data Exposure – P4 Broken…