b0ysie7e

Skip to content

Main Navigation Home Notas Dev Malware

Appearance

Sidebar Navigation

WRITE-UP

DockerLabs

QueueMedic

Tryhackme

Mustacchio

CMSpit

Bookstore

Anonymous

Blueprint

Fowsniff CTF

Kiba

TechSupport

Corridor

Ninja Skills

Smag Grotto

Glitch

Flatline

Hacker vs Hacker

Valley

B3dr0ck

Tony The Tiger

Opacity

Red

Ollie

Cyber Crafted

Masterminds

Olympus

Zeno

Biteme

The Server From Hell

Battery

Sustah

Splunk PS Eclipse

Web Strike Blue Team

Gatekeeper

Willow

Borderlands

Kitty

Eavesdropper

Buffer Overflow Prep

Relevant

VulnneTroasted

Hackthebox

TwoMillion

Validation

Bounty

Doctor

Cap

Support

Timelapse

Return

Authority

Escape

Scrambled

StreamIO

Intelligence

Monteverde

Resolute

Pov

Broker

Perfection

Codify

Devvortex

Headless

Keeper

Pilgrimage

Wifinetic

Topology

PC

MonitorsTwo

Busqueda

Inject

Titanic

LinkVortex

PortSwigger

SQL Injection

Lab - 1: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data

Lab - 2: SQL injection vulnerability allowing login bypass

Lab - 3: SQL injection attack, querying the database type and version on Oracle - portswigger

Lab - 4: SQL injection attack, querying the database type and version on MySQL and Microsoft - portswigger

Lab - 5: SQL injection attack, listing the database contents on non-Oracle databases - portswigger

Lab - 6: SQL injection UNION attack, determining the number of columns returned by the query - portswigger

Lab - 7: SQL injection UNION attack, retrieving data from other tables - portswigger

Lab - 8: SQL injection UNION attack, retrieving multiple values in a single column - portswigger

Lab - 9: Blind SQL injection with conditional responses - portswigger

Lab - 10: Blind SQL injection with conditional errors - portswigger

Lab - 11: Visible error-based SQL injection - portswigger

Lab - 12: Blind SQL injection with time delays- portswigger

Lab - 13: Blind SQL injection with time delays and information retrieval

Lab - 14: Blind SQL injection with out-of-band interaction

Lab - 15: Blind SQL injection with out-of-band data exfiltration

Lab - 16: SQL injection with filter bypass via XML encoding

Cross-site scripting

Lab - 1: Reflected XSS into HTML context with nothing encoded

Lab - 2: Stored XSS into HTML context with nothing encoded

Lab - 3: DOM XSS in `document.write` sink using source `location.search`

Lab - 4: DOM XSS in innerHTML sink using source location.search

Lab - 5: DOM XSS in jQuery anchor `href` attribute sink using `location.search` source

Lab - 6: DOM XSS in jQuery selector sink using a hashchange event

Lab - 7: Reflected XSS into attribute with angle brackets HTML-encoded

Lab - 8: Stored XSS into anchor `href` attribute with double quotes HTML-encoded

Lab - 9: Reflected XSS into a JavaScript string with angle brackets HTML encoded

Lab - 10: DOM XSS in `document.write` sink using source `location.search` inside a select element

Lab - 11: DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded

Lab - 12: Reflected DOM XSS

Lab - 13: Stored DOM XSS

Lab - 14: Reflected XSS into HTML context with most tags and attributes blocked

Lab - 15: Reflected XSS into HTML context with all tags blocked except custom ones

Lab - 16: Reflected XSS with some SVG markup allowed

Lab - 17: Reflected XSS in canonical link tag

Lab - 18: Reflected XSS into a JavaScript string with single quote and backslash escaped

Lab - 19: Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped

Lab - 20: Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped

Lab - 21: Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped

Lab - 22: Exploiting cross-site scripting to steal cookies

Lab - 23: Exploiting cross-site scripting to capture passwords

Lab - 24: Exploiting XSS to bypass CSRF defenses

Lab - 25: Reflected XSS protected by very strict CSP, with dangling markup attack

CSRF

Lab - 1 : CSRF vulnerability with no defenses

Lab - 2 : CSRF where token validation depends on request method

Lab - 3 : CSRF where token validation depends on token being present

Lab - 4 : CSRF where token is not tied to user session

Lab - 5 : CSRF where token is tied to non-session cookie

Lab - 6 : CSRF where token is duplicated in cookie

Lab - 7 : SameSite Lax bypass via method override

Lab - 8 : SameSite Strict bypass via client-side redirect

Lab - 9 : SameSite Strict bypass via sibling domain

Lab - 10 :SameSite Lax bypass via cookie refresh

Lab - 11 :CSRF where Referer validation depends on header being present

Lab - 12 :CSRF with broken Referer validation

Path_Traversal

Lab - 1 : File path traversal, simple case

Lab - 2 : File path traversal, traversal sequences blocked with absolute path bypass

Lab - 3 : File path traversal, traversal sequences stripped non-recursively

Lab - 4 : File path traversal, traversal sequences stripped with superfluous URL-decode

Lab - 5 : File path traversal, validation of start of path

Lab - 6 : File path traversal, validation of file extension with null byte bypass

Authentication vulnerabilities

Lab - 1 : Username enumeration via different responses

Lab - 2 : Username enumeration via subtly different responses

Lab - 3 : Username enumeration via response timing

Lab - 4 : Broken brute-force protection, IP block

Lab - 5 : Username enumeration via account lock

Lab - 6 : 2FA simple bypass

Lab - 7 : 2FA broken logic

Lab - 8 : Brute-forcing a stay-logged-in cookie

Lab - 9 : Offline password cracking

Lab - 10 : Password reset broken logic

Lab - 11 : Password reset poisoning via middleware

Lab - 12 : Password brute-force via password change

SSRF

Lab - 1 : Basic SSRF against the local server

Lab - 2 : Basic SSRF against another back-end system

Lab - 3 : SSRF with blacklist-based input filter

Lab - 4 : SSRF with filter bypass via open redirection vulnerability

Lab - 5 : Blind SSRF with out-of-band detection

CORS

Lab - 1 : CORS vulnerability with basic origin reflection

Lab - 2 : CORS vulnerability with trusted null origin

Lab - 3 : CORS vulnerability with trusted insecure protocols

Clickjacking

Lab - 1 : Basic clickjacking with CSRF token protection

Lab - 2 : Clickjacking with form input data prefilled from a URL paramete

Lab - 3 : lickjacking with a frame buster script

Lab - 4 : Exploiting clickjacking vulnerability to trigger DOM-based XSS

Lab - 5 : Multistep clickjacking

DOM-based vulnerabilities

Lab - 1 : DOM XSS using web messages

Lab - 2 : DOM XSS using web messages and a JavaScript URL

Lab - 3 : DOM XSS using web messages and JSON.parse

Lab - 4 : DOM-based open redirection

Lab - 5 : DOM-based cookie manipulation

OS Command injection

Lab - 1 : OS command injection, simple case

Lab - 2 : Blind OS command injection with time delays

Lab - 3 : Blind OS command injection with output redirection

Lab - 4 : Blind OS command injection with out-of-band interaction

Lab - 5 : Blind OS command injection with out-of-band data exfiltration

Business logic vulnerabilities

Lab - 1 : Excessive trust in client-side controls

Lab - 2 : High-level logic vulnerability

Lab - 3 : Inconsistent security controls

Lab - 4 : Flawed enforcement of business rules

Lab - 5 : Low-level logic flaw

Lab - 6 : Inconsistent handling of exceptional input

Lab - 7 : Inconsistent handling of exceptional input

Lab - 8 : Insufficient workflow validation

Lab - 9 : Authentication bypass via flawed state machine

Lab - 10 : Infinite money logic flaw

Lab - 11 : Authentication bypass via encryption oracle

File Upload Vulnerabilities

Lab - 1 : Remote code execution via web shell upload

Lab - 2 : Web shell upload via Content-Type restriction bypass

Lab - 3 : Web shell upload via path traversal

Lab - 4 : Web shell upload via extension blacklist bypass

Lab - 5 : Web shell upload via obfuscated file extension

Lab - 6 : Remote code execution via polyglot web shell upload

Race conditions

Lab - 1 : Limit overrun race conditions

Lab - 2 : Bypassing rate limits via race conditions

Lab - 3 : Multi-endpoint race conditions

Lab - 4 : Single-endpoint race conditions

Lab - 5 : Exploiting time-sensitive vulnerabilities

XML external entity (XXE)

Lab - 1 : Exploiting XXE using external entities to retrieve files

Lab - 2 : Exploiting XXE to perform SSRF attacks

Lab - 3 : Blind XXE with out-of-band interaction

Lab - 4 : Blind XXE with out-of-band interaction via XML parameter entities

Lab - 5 : Exploiting blind XXE to exfiltrate data using a malicious external DTD

Lab - 6 : Exploiting blind XXE to retrieve data via error messages

Lab - 7 : Exploiting XInclude to retrieve files

Lab - 8 : Exploiting XXE via image file upload

Server-side template injection (SSTI)

Lab - 1 : Basic server-side template injection

Lab - 2 : Basic server-side template injection (code context)

Lab - 3 : Server-side template injection using documentation

Lab - 4 : Server-side template injection in an unknown language with a documented exploit

Lab - 5 : Server-side template injection with information disclosure via user-supplied objects

HTTP request smuggling

Lab - 1 : HTTP request smuggling, confirming a CL.TE vulnerability via differential responses

Lab - 2 : HTTP request smuggling, confirming a TE.CL vulnerability via differential responses

Lab - 3 : Exploiting HTTP request smuggling to bypass front-end security controls, CL.TE vulnerability

Lab - 4 : Exploiting HTTP request smuggling to bypass front-end security controls, TE.CL vulnerability

Lab - 5 : Exploiting HTTP request smuggling to reveal front-end request rewriting

Lab - 6 : Exploiting HTTP request smuggling to capture other users requests

Lab - 7 : Exploiting HTTP request smuggling to deliver reflected XSS

Lab - 8 : Response queue poisoning via H2.TE request smuggling

Lab - 9 : H2.CL request smuggling

Lab - 10 : HTTP 2 request smuggling via CRLF injection

Lab - 11 : HTTP 2 request splitting via CRLF injection

Lab - 12 : CL.0 request smuggling

Lab - 13 : HTTP request smuggling, basic CL.TE vulnerability

Lab - 14 : HTTP request smuggling, basic TE.CL vulnerability

Lab - 15 : HTTP request smuggling, obfuscating the TE header

Access control vulnerabilities

Lab - 1 : Unprotected admin functionality

Lab - 2 : Unprotected admin functionality with unpredictable URL

Lab - 3 : User role controlled by request parameter

Lab - 4 : User role can be modified in user profile

Lab - 5 : User ID controlled by request parameter

Lab - 6 : User ID controlled by request parameter, with unpredictable user IDs

Lab - 7 : User ID controlled by request parameter with data leakage in redirect

Lab - 8 : User ID controlled by request parameter with password disclosure

Lab - 9 : Insecure direct object references

Lab - 10 : URL-based access control can be circumvented

Lab - 11 : Method-based access control can be circumvented

Lab - 12 : Multi-step process with no access control on one step

Lab - 13 : Referer-based access control

WebSockets

Lab - 1 : Manipulating WebSocket messages to exploit vulnerabilities

Lab - 2 : Cross-site WebSocket hijacking

Lab - 3 : Manipulating the WebSocket handshake to exploit vulnerabilities

Insecure deserialization

Lab - 1 : Modifying serialized objects

Lab - 2 : Modifying serialized data types

Lab - 3 : Using application functionality to exploit insecure deserialization

Lab - 4 : Arbitrary object injection in PHP

Lab - 5 : Exploiting Java deserialization with Apache Commons

Lab - 6 : Exploiting PHP deserialization with a pre-built gadget chain

Lab - 7 : Exploiting Ruby deserialization using a documented gadget chain

Information disclosure

Lab - 1 : Information disclosure in error messages

Lab - 2 : Information disclosure on debug page

Lab - 3 : Source code disclosure via backup files

Lab - 4 : Authentication bypass via information disclosure

Lab - 5 : Information disclosure in version control history

HTTP Host header attacks

Lab - 1 : HTTP Host header attacks

Lab - 2 : Host header authentication bypass

Lab - 3 : Web cache poisoning via ambiguous requests

Lab - 4 : Routing-based SSRF

Lab - 5 : SSRF via flawed request parsing

Lab - 6 : Host validation bypass via connection state attack

OAuth authentication

Lab - 1 : Authentication bypass via OAuth implicit flow

Lab - 2 : SSRF via OpenID dynamic client registration

Lab - 3 : Forced OAuth profile linking

Lab - 4 : OAuth account hijacking via redirect_uri

Lab - 5 : Stealing OAuth access tokens via an open redirect

Jwt

Lab - 1 : JWT authentication bypass via unverified signature

Lab - 2 : JWT authentication bypass via flawed signature verification

Lab - 3 : JWT authentication bypass via weak signing key

Lab - 4 : JWT authentication bypass via jwk header injection

Lab - 5 : JWT authentication bypass via jku header injection

Lab - 6 : JWT authentication bypass via kid header path traversal

Lab - 7 : JWT authentication bypass via algorithm confusion

Lab - 8 : JWT authentication bypass via algorithm confusion with no exposed key

Essential skills

Lab - 1 : Discovering vulnerabilities quickly with targeted scanning

Lab - 2 : Scanning non-standard data structures

Prototype pollution

Lab - 1 : Client-side prototype pollution via browser APIs

Lab - 2 : DOM XSS via client-side prototype pollution

Lab - 3 : DOM XSS via an alternative prototype pollution vector

Lab - 4 : Client-side prototype pollution via flawed sanitization

Lab - 5 : Client-side prototype pollution in third-party libraries

Lab - 6 : Privilege escalation via server-side prototype pollution

Lab - 7 : Detecting server-side prototype pollution without polluted property reflection

Lab - 8 : Bypassing flawed input filters for server-side prototype pollution

Lab - 9 : Remote code execution via server-side prototype pollution

GraphQL API vulnerabilities

Lab - 1 : Accessing private GraphQL posts

Lab - 2 : Accidental exposure of private GraphQL fields

Lab - 3 : Finding a hidden GraphQL endpoint

Lab - 4 : Bypassing GraphQL brute force protections

Lab - 5 : Performing CSRF exploits over GraphQL

NoSQL injection

Lab - 1 : Detecting NoSQL injection

Lab - 2 : Exploiting NoSQL operator injection to bypass authentication

Lab - 3 : Exploiting NoSQL injection to extract data

Lab - 4 : Exploiting NoSQL operator injection to extract unknown fields

Web cache deception

Lab - 1 : Exploiting path mapping for web cache deception

Lab - 2 : Exploiting path delimiters for web cache deception

Lab - 3 : Exploiting origin server normalization for web cache deception

Lab - 4 : Exploiting cache server normalization for web cache deception

NOTAS

Pentesting

Comandos

Enumeracion De Hosts

Enumeracion de puertos

Footprinting

Domain Information

FTP

SMB

NFS

DNS

SMTP

IMAP-POP3

SNMP

MySQL

MSSQL

OracleTNS

IPMI

Linux Remote Management Protocols

Windows Remote Management Protocols

Buffer

Pivoting-tunneling-port-forwarning

Port Forwarning ssh

Pivoting Metasploit

Socat Redirection with Reverse Shell

Socat Redirection with a Bind Shell

Others Tools

Transderencia de Archivos

Evading Detection

Linux File Transfer Methods

Miscellaneous File Transfer Methods

Transferring Files with Code

Windows-File-Transfer-Methods

Otros

Usando ICMP

Usando Ncat y Tar

Shell Payloads

Spawning Interactive

Conection RDP

Password Attacks

Cracking

Windows Local Password Attacks

Linux Local Password Attacks

Windows-Lateral-Movement

Fuerza Bruta

Pentesting Web

Sqlmap

Database Enumeration

SQLmap

Cross Site Scripting

File Inclusion

File Inclusion

Remote File Inclusion

LFI y File Inclusion

Escaneos Automáticos

Command Injections

Command Injections

Filter Evasion

Web Attacks

Http Verb Tampering

IDOR

XXE

Attacking Common Applications

Enumeración web

Wordpress

Joomla

Drupal

Tomcat

Jenkins

Web Fuzzing

Directory and File Fuzzing

Server-side Attacks

Server-side Request Forgery - SSRF

Server Side Template Injection - SSTI

Server-Side Includes - SSI

XSLT Injection

Broken Authentication

Broken Authentication

Attacking GraphQL

Information Disclosure

Insecure Direct Object Reference

Injection Attacks

API

Broken Object Level Authorization

Broken Authentication

Broken Object Property Level Authorization

Unrestricted Resource Consumption

Broken Function Level Authorization

Unrestricted Access to Sensitive Business Flows

Server Side Request Forgery

Security Misconfiguration

Improper Inventory Management

Unsafe Consumption of APIs

Escalada de Privilegios

Linux

Enumeración en Linux

Variables de entorno

Permisos

Servicios

Linux Internal

Otros

Enumeración automatizada - Tools

Kernel Exploit

Sudo

SUID

Capabilities

Cron Jobs

Path

NFS

Windows

Enumeracion en Windows

Windows User Privilege

Windows Group Privilege

Attacking the OS

Credetial Hunting

Otros

Enumeración automatizada - Tools

Harvesting Passwords from Usual Spots

Other Quick Wins

Abusing Service Misconfigurations

Abusing dangerous privileges

Abusing vulnerable software

GUIAS Y HERRAMIENTAS

MetaSploit

Introducción

Modules

Targets

Payloads

Encoders

Sessions

Nmap

Git

Fortinet

Configuracion Estatica de FW

Licenciadel Firewall

Configuracion de Interfaces

Creando Politicas

Rutas Estaticas

Metodología

On this page

LAB

Ene l sitio web encontraremos en el código html la ruta /cgi-bin/phpinfo.php

El cual es un archivo en el que revela variables de entorno.

Pager

Previous pageLab - 1 : Information disclosure in error messages

Next pageLab - 3 : Source code disclosure via backup files