Matthew learns Pentesting/EH

 So like I said we are going over mitigations and I grabbed a couple slides and while this is not everything, I grabbed ones that helped to spark a thought process and understand how mitigation can be performed. Now we started with SMB Relay because we were told its one of the most exploited vulnerabilities. Really until this slide I was thinking "if it's such a known vulnerability why is it still being used?" And seeing this slide with the pros and cons made me realize certain things need to be used and our job as security professionals can't be just to shut down everything that can be exploited but rather make things as safe as possible so that our companies can still be as productive as possible while being as safe as possible. Now I always thought I knew strong passwords but in taking this course I found out just how easy password cracking is. So, 14 or more characters and make it complex.  Capital, Lowercase, Numbers, Special Characters, stay away from common wor...

Here we learn a little about LLMNR. So here is a description of the attack. I think the key here is that it provides the hash. These days anytime you can get a hash it's a win. Even if its long and complex, hash cracking tools are a 3 second google search.  I like graphics like this cause to be honest, even if I know how to attack it I am not always sure how to mitigate what I am doing. Its why I like learning what is behind the scenes. In the next few posts, I am going to show some mitigation techniques the course brought up and the reason for that is it really helped me start to think about how to mitigate. Again, I will not be sharing everything and if you want to learn more, please go check out  TCM Security . This has really been a great course to get my brain thinking in ways to help businesses.  And here are their recommendations for mitigation. And this is just to get your brain in the mode of mitigation. Remember we are doing this to help businesses not just to d...

 Now this exploit for my rig was a little hard just because I do not have the most RAM and it required slightly more than the others. So I took less screenshots  This again is the same step as the others. Figuring out what ports were available  Here we are using "ffuf" again Now I believe this is the first time we used "dnsrecon" And here we add the dns to our machine so we can perform the attack Follow me at  LinkedIn  or  Twitter

This is the Dev machine through  TCM's  Practical Ethical Hacking course. Here we did the same thing as the last box "dhclient" and "ip a"  Here we run "nmap" to find open ports. This is the fourth or fifth exploit and what I have realized is the first several steps, rather it's on a windows or Linux machine, is the same. Here I showed all the ports because some of the important ports were a little out of site on the previous slide Here we are obtaining some vital information. We were able to see the php page and get some good information.  Using "ffuf" again to gain some enumeration. Here we used "searchsploit" for the first time.  Now following this we used the information gathered to gain privilege escalation and captured the flag. Follow me on  LinkedIn  or  Twitter

 This is the Academy VMware exploit. I was asked not to post the whole thing so I have most of it on here. This is me getting access to the box First you run "dhclient" then "ip a" to get the ip address of the box you are going to attack  Here we run "nmap" to find out what ports are open, what can we exploit? Here we use "ftp" to connect and see an interesting "note.txt" file Here we "cat" the "note.txt" file. If you notice it gives us a lot of valuable info Here we use "dirb" to directory bust the target Here is the first time I used "ffuf"  Here listened and were able to obtain root access and capture the flag Follow me or reach out at  LinkedIn  or  Twitter

 Here are my notes from the functions lesson of the PEH. I think this was a fairly easy lesson to follow along with. My biggest take away I think is the importance of the indentation. As well as the fact that you can have single or multiple parameters. And as a reminder the '#' on the right-hand side of the code are my notes for later. I have always like keeping shorthand reminders that call back things rather than long drawn-out notes. But if you need any clarification please comment or message me on my social medias and I will try and elaborate.  Remember feel free to contact me on  LinkedIn  or  Twitter

 This lesson was short and sweet and easy to understand. So, a Boolean expression is just an expression of true and false. Which my understanding is that it comes in handy later on when you call functions like, if such and such is true then do blah. Please find me on  LinkedIn  or  Twitter

Today was pretty fun. It was a simple lesson but one I think will be handy. I am a huge math geek. My 3 year old and I randomly add the numbers we see on the street and he is getting to the point he can do his multplication tables up to 10 already. So learning that python can do math by scripting it makes sense but I can also see how that might be handy in the future when I am writing more advanced scripts for vulnerabilities in a system. As I am sure I have said pentesting isnt where I want to stop. I want to go full red team and overall I want to be good at as much in cyber as possible. I mean the goal is to do as much good with this knowledge as possible so learning scripting on all angles would make me more effective but anyways, we did some simple scripting for math and it sounded like we will get to the more advanced in a later lesson.  Check it out and if you know of some simple scripts I can add to my math knowledge let me know I would love to give it a try. Feel free to re...

 Ok so today's is one of those things where I am not proud it took so long but I am proud that I finally came up with a solution.  On pentesterlab I have been trying for a couple hours to use burp repeater to do a file upload injection but for some reason it wouldn't work. So, I decided to switch to using OWASP Zap to try on that tool and it didn't work.  I started getting frustrated and decided I would step back and try and think about a different way to do things. Then I realized all I was trying to do was rename a file from test.php to test.php3 and upload it and repeater was just stopping me from having to rewrite the file on my desktop. SO, I figured I had already written the php code, so I went in copied what was in the file and created a new file with the test.php3 name and uploaded it the regular way. Now I know this is not the way pentesterlab has it set up BUT.... I would argue this. I spent probably 3 hours trying to do it their way. And time and again in the l...

 So, I have stated that when I am stuck, I take a step back for a few minutes, but I wanted to explain that I don't just go and do nothing.  True there are times when I go play with my son or cook my family lunch, or whatever. But for me my learning right now is to a point that I feel like I need it for my sanity. But on the same hand when I get stuck on something that, maybe I think I shouldn't it drives me nuts, LOL. I have high expectations of myself, so I can get hard on myself when I don't immediately get something. But back to the topic. Let's take this morning for example, I was working through what should have been an easy task on  PentesterLab , but one of my computers is down so I am working on the one I never installed VIM on, which this exercise called for. I thought no problem how hard can it be to install VIM on Windows. And I was correct it wasn't that hard. I started going through the task and it wasn't working, and I couldn't tell why. So, I...