Tomato 1 - VulnHub
Medium difficulty machine in which an LFI is exploited, gaining access to the SSH log and using a not so common privilege escalation method.
SSH log poisoning LFI C Kernel Ubuntu PHPMedium difficulty machine in which an LFI is exploited, gaining access to the SSH log and using a not so common privilege escalation method.
SSH log poisoning LFI C Kernel Ubuntu PHPBeginner real life based machine designed to teach people the importance of understanding from the interior.
ldap wrappers PHP injection LFIBilly Joel made a blog on his home computer and has started working on it. It’s going to be so awesome! Enumerate this box and find the 2 flags that are hiding on it! Billy has some weird things going on his laptop. Can you maneuver around and get what you need? Or will you fall down the rabbit hole…
WordPress RCE Bruteforce SUIDIntermediate real life based machine designed to test your skill at enumeration. If you get stuck remember to try different wordlist, avoid rabbit holes and enumerate everything thoroughly. SHOULD work for both VMware and Virtualbox.
Shellshock cgi-bin python cron pspy tcpdumpA box involving encrypted archives, source code analysis and more.
John borg sudoers bash codeBlackMarket VM presented at Brisbane SecTalks BNE0x1B (28th Session) which is focused on students and other InfoSec Professional. This VM has total 6 flag and one r00t flag. Each Flag leads to another Flag and flag format is flag{blahblah}. Difficulty: Beginner/Intermediate
SQLI CTF squirrelmail Hydra PHPThe goal of this capture the flag is to gain root access to the target machine. The difficulty level is marked as easy. As a hint, it is mentioned that enumerating properly is the key to solving this CTF. Prerequisites would be knowledge of Linux commands and the ability to run some basic pentesting tools.
ssh log poisoning john LFIWe are Horror LLC, we specialize in horror, but one of the scarier aspects of our company is our front-end webserver. We can’t launch our site in its current state and our level of concern regarding our cybersecurity is growing exponentially. We ask that you perform a thorough penetration test and try to compromise the root account. There are no rules for this engagement. Good luck!
javascript nodejs deserialization burpsuite base64