offensive cyber
64 Topics- 582Views0likes1Comment
Your first lab level 9
What was the first level 9 lab you conquered? :). It does not matter that you will seek advice from other giants, or that you will manage to complete it on your own: share your journey with us!; to get the token or become root on that server. I start: I think that my first conquest of Lab level 9 is related to debugging ByteCode in Java (and only a few days ago!): my background is Oracle, and from years ago, so imagine how lost I was :). After loading the project into the IDE (along with the required plugin) I started debugging bit by bit... until one particular string caught my attention; it stood out from the rest!. And it was the solution :). Good luck!439Views2likes10CommentsServer-Side Request Forgery
I need help with step 5 and 6 of Server-Side Request Forgery lab. I was able to find the location of potential SSRF i.e "lookup?url=http://localhost:3000/online" after that I have tried directory traversal and other methods in place of HTTP (FTP). Nothing seems to working to get the bot name/service accountSolved430Views1like4CommentsReverse Engineering (Offensive) JavaScript Analysis: JSDetox
I'm stuck at below two questions Q6: Which variable does the initial script try to return? Q8: The exploit kit contains a large block of hex encoded shellcode stored in a variable. This shellcode is also XOR encoded. What is the single byte xor key? (In the format 0xNN e.g. 0x11.) So far I downloaded the HTTP objects via Wireshark, extracted the script to JSDetox then decoded base64 strings which resolves to other 2 scripts. With these steps I was able to answer other questions but I can't go any further, any guidance? Thanks in advanceSolved421Views1like10CommentsPen Test CTFs: Jinja2 Exploitation
Good morning Team, This one has my head spinning and i feel like im tickling the method but not quite pulling it off. "Jinja2 is a templating engine for Python. It's often used with Flask web applications all over the internet. Templating engines are often vulnerable to Server-Side Template Injection (SSTI), which allows an attacker to inject a template directive as user input that could result in the execution of arbitrary code on the server. This system has a template injection vulnerability in the registration flow. If you try to create an account with a duplicate email address, the email address is passed into the template rendering engine. This email address can contain template syntax, allowing arbitrary code execution. To make things more complicated, the injected value can't be longer than a certain length and must match the expected format of an email address." I have to read the file within /data/token.txt but the strict syntax is keeping at bay. Could anyone offer some direction for this, please.Solved359Views1like8CommentsHow do you use the clipboard feature within labs?
Can anyone tell me how I can use the clipboard feature within labs?Solved330Views0likes2Comments💻🔐 Study Group Announcement - Offensive Cybersecurity Lab Chosen! 💻🔐
You may have heard that we're launching a Study Group within the community. And for the first time, the votes are in, and we’re diving into Offensive Cybersecurity for our very first Study Group 🖥️💥 This week, we’ll be exploring hands-on tactics in offensive cybersecurity in a safe, controlled environment, and the chosen lab is Hack Your First Web App: Ep.1 – Ozone Energy How to get involved: Dive into the lab: Get started on the lab and challenge yourself to complete it by the end of the week. Join the discussion: Don’t forget to share your experiences, ask questions, and drop any tips or tricks you’ve picked up along the way in this forum discussion. Support each other: This is all about collaboration—whether you’re struggling with a concept or want to share an "aha" moment, jump into the conversation! Remember, we’ll re-vote on Friday for next week’s lab, so stay engaged and help shape where this study group goes. Let’s learn together and level up our skills! Every community member who has access to an Immersive license is welcome to join this study group. Happy hacking! 🔓💻317Views3likes9Comments