HackTheBox ScriptKiddie

Machine IP: 10.10.10.226 DATE : 16/06/2021 Reconocimiento Primero hacemos un escaneo de puertos para saber cuales están abiertos y conocer sus servicios correspondientes. Nmap ┌──(s4yhii㉿kali)-[~] └─$ nmap -p- --open -T5 -v -n 10.10.10.226 Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-15 20:45 EDT Initiating Ping Scan at 20:45 Scanning 10.10.10.226 [2 ports] Completed Ping Scan at 20:45, 0.12s elapsed (1 total hosts) Initiating Connect Scan at 20:45 Scanning 10.10.10.226 [65535 ports] Discovered open port 22/tcp on 10.10.10.226 Stats: 0:00:20 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan Connect Scan Timing: About 29.62% done; ETC: 20:46 (0:00:48 remaining) Discovered open port 5000/tcp on 10.10.10.226 Completed Connect Scan at 20:46, 60.38s elapsed (65535 total ports) Nmap scan report for 10.10.10.226 Host is up (0.12s latency). Not shown: 52711 closed ports, 12822 filtered ports Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE 22/tcp open ssh 5000/tcp open upnp Read data files from: /usr/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 60.62 seconds Como vemos tiene 2 puertos abiertos el 22 y el 5000 uno con el servicio ssh y el otro con el servicio de Plug and Play, que se usa para conectar impresoras, dispositivos bluetooh, etc. ...

June 16, 2021 · 4 min · 667 words · Jesus Lujan

HackTheBox Bashed

Machine IP: 10.10.10.68 DATE : 13/06/2021 Reconocimiento Primero hacemos un escaneo de puertos para saber cuales están abiertos y conocer sus servicios correspondientes. Nmap Como vemos solo el puerto 80 está abierto, así que investigaremos en la web para ver si encontramos algo interesante En la web no encontré nada :,c, pero phpbash me da una pista. Como vemos es un frontend normal,pero el nombre php bash es algo sospechoso al parecer no muestra directorios, por eso le hacemos un brute force para enumerar los directorios con gobuster. ...

June 13, 2021 · 3 min · 624 words · Jesus Lujan

Some acronyms: JOSE: Javascript Object Signing and Encryption The name of the working group JWT: JSON Web TOKEN JWE: JSON Web Encryption JWS: JSON Web Signature JWK: JSON Web Key JWA: JSON Web Algorithm “Encryption gives you confidentiality but signature gives you integrity” JWT has 3 parts separated by a dot: Header (base 64 url encoded without padding(no ‘/’, ‘+’, ‘=’)) Contain an algorithm “alg” attribute to tell how the token was signed Support a lot of different algorithms (HS256, HS384, HS512, None, …) Payload (base 64 url encoded without padding no ‘/’, ‘+’, ‘=’)) May contain anything Use registered claims “iss”: issuer “sub”: subject “aud”: audience “jti”: claim id “exp”: expiration time “nbf”: not before “iat”: issued at Signature (base 64 encoded) The JWT Format: Algorithms ...

1 min · 210 words · Jesus Lujan

Docker Cheatsheet

“With Docker, developers can build any app in any language using any toolchain. “Dockerized” apps are completely portable and can run anywhere - colleagues” OS X and Windows laptops, QA servers running Ubuntu in the cloud, and production data center VMs running Red Hat. Basic Commands Verified cli can talk to engine docker version Most config values of engine docker info docker ps #see al docker running docker top <name> #see info about the container Docker command line structure ...

2 min · 214 words · Jesus Lujan