offensive cyber

25 Topics

Reverse Engineering (Offensive) JavaScript Analysis: JSDetox
I'm stuck at below two questions Q6: Which variable does the initial script try to return? Q8: The exploit kit contains a large block of hex encoded shellcode stored in a variable. This shellcode is also XOR encoded. What is the single byte xor key? (In the format 0xNN e.g. 0x11.) So farI downloaded the HTTP objects via Wireshark, extracted the script to JSDetox then decoded base64 strings which resolves to other 2 scripts. With these steps I was able to answer other questions but I can't go any further, any guidance? Thanks in advance
Solved
AtakanBal
8 days ago Place Help & Support Forum
166Views
1like
9Comments
dotCMS Remote Code Execution (CVE-2022-26352)
Hi all, I completed all steps and got RCE, I thought I found the password but lab says its not valid. Please check the screenshots. Is it a lab error or..? Thanks in advance
Solved
AtakanBal
10 days ago Place Help & Support Forum
57Views
1like
3Comments
Return to Haunted Hollow: Haunted Helpdesk
Hello everyone, I'm stuck in Q2 of Return to Haunted Hollow (escalate to root). Does anyone have any hint about what binary or service can be exploited to elevate privileges? Kind regards,
Solved
T3S0r0
22 days ago Place Help & Support Forum
121Views
2likes
6Comments
IoT & Embedded Devices: Certificate Underpinning
I'm stuck at the step 5 "Create a Python script to exploit the alarm system".I tried to set up a TCP listener on localhost for port 443 but I didn't have any activity from any user. Any tips on how to proceed?
AtakanBal
24 days ago Place Help & Support Forum
268Views
1like
6Comments
Server-Side Request Forgery
I need help with step 5 and 6 of Server-Side Request Forgery lab. I was able to find the location of potential SSRF i.e "lookup?url=http://localhost:3000/online" after that I have tried directory traversal and other methods in place of HTTP (FTP). Nothing seems to working to get the bot name/service account
Akshay
2 months ago Place Help & Support Forum
83Views
1like
4Comments
OWASP 2017 Java: Underprotected APIs
I am stuck on the "OWASP 2017 Java: Underprotected APIs" challenge. I have tried accessing "<Target URL>/FileDownloadServlet?path=/etc/&file=flag.txt," for which I received the error message "HACKING DETECTED! Your activity has been logged, and authorities have been informed." I created a user with admin privileges and used its session to access the above-mentioned URL, but that also didn't work.
Solved
Akshay
2 months ago Place Help & Support Forum
67Views
2likes
1Comment
Can you tell me why I am seeing the page that says ‘You are not licensed to view this content’?
Why am I receiving this message within Immersive Labs?
Solved
TillyCorless
5 months ago Place Help & Support Forum
161Views
0likes
1Comment
Can labs count towards my CPE credits?
I was wondering if completing the labs could count towards my CPE credits?
Solved
TillyCorless
5 months ago Place Help & Support Forum
68Views
1like
2Comments
Navigating to completed lab answers
How can I get back into the lab to see my answers after completing it?
Solved
TillyCorless
5 months ago Place Help & Support Forum
91Views
0likes
1Comment
What labs should I do?
I'm looking for some Offensive Cyber challenges - what should I do? ✨
Solved
NyePrior
6 months ago Place Help & Support Forum
55Views
2likes
1Comment