user.txtFron nmap I have 3 ports open. 22,80,443. On port 80 I get nginx default page, doing directory bruteforcing leads to nowhere.I look at port 443 and get a hostname docker.registry.htb. This sho

tl&dr Port 80 was the port I attacked. On other ports I had no access. Found several directories by using gobuster, but on /blog directory there was a parameter including a .php file. And I s

Forest 🌲ReconA lot of open ports found in this windows box 53,88,135,139,389,445,464,593,636,3268,3269, First I am going to try smb on port 445 using smbmap smbmap -H 10.10.10.161 to see if any of th

ZettaSummary: A hard box for me but in general I learned a lot. I did get help on the part with rsyslog and logger.User Part.Port 80 and port 22 were open. I start to look at the webserver first. From

Takeaways from RE boxThe Re box created from 0xdf was retired later this day. I did solve the box after it was retired so now I am going to show you some key things I learned from this box. A list of

On port 80 there is a webserver, running gobuster we find /backup. Download the backup.tar. See the source code, but also the filenames of some of the web apps functionallity.On upload.php, we ca

Wall 🧱From port scanning two ports are only available 22,80. All I see in this port is the default page of apache2. So I fire up gobuster at this time. gobuster dir -w /usr/share/wordlists/directory-

UserPort scanning gives me two ports, 22,80. which both are well known to me. I goto 80/http because I don’t have any credentials for port 22. On port 80 all I see is a web app which it’s purpo

Port 80 and 22, are open. Visiting 80 we see a gitlab server, I find the credentials http://10.10.10.114/help/bookmarks.html at this url, and when I click Github Login, I see obfuscated javascript. I