Bresleveloper Digital - the best at SharePoint, PowerApps and Office365, Contact us now!

hopefully, lets try to do all of the  CTF365 Security Shepherd  lessons and challenges, and help everybody with all they need but no spoilers. that doens't meant you don't need to do your learning, if i didn't write something, that means (a) learn the topic (b) read instructions. simple way to work through is installing burp-suite CE and make it work with ssl, but i'll try to also teach, where possible, you can use other tools. LESSONS *any lession with a asterisk [*] in its name means that it would have been easier with burp, just altering the request. [need to install cert. etc.] Broken Session Management* the session is managed via cookies, can be changed via Chrome Dev Tools (F12) -> Application tab -> Storage -> Cookies. (maybe you must click the button 1st) Cross-Site Request Forgery after putting a value in the box and submitting, right-click and Inspect-Element the image. you must put a full url i.e. https://..... try put a funny image...

today we are going to have some fun understanding the full potential of File Inclusion attacks. my goals for today 1. a few words, Disclaimer, Lab, and links. 2. Web Shells intro with DVWA 3. How to complete the File Inclusion challenge in the new DVWA 4. Metasploit 1. a few words, Disclaimer, Lab, and links. DISCLAIMER - if you do what i teach you today you WILL go to jail. so dont do this outside of your lab. Setting up the lab - For a hacking lab download either VirtualBox or VMWare, or, if you own win10pro, you have Hyper-V. With those you can create virtual machines, and you will need 2 today, one with DVWA, and another as the attacker, which for ease better be kali, download machines from osboxes . For DVWA you can either download Metasploitable 2 or set up dvwa in some machine. In my case i just turned them both on an internal network, so they can see each other but no internet (might need to set up DHCP if you dont have any ip). For basic help about solvi...

the challenge is like this, i have the attacker machine (A), which connect with ssh client to another machine (B), which run ssh server (daaa...), these 2 are connected to the internet, but (B) is also connected to an internal network, and there there is a WIN10 machine (C), NOT connected to the internet but to (B) as said. we will use the help of ssh, ShellTer  to try also do it with windows defender on. to succeed we will try to do this from bottom to top. *DISCLAIMER - all this is illegal, and you may only do it at your lab, if you hack really you will go to jail. *BIG NOTE : sometimes stuff just dont work, restarting (not power off) the machines, and the services refreshes stuff and then they work. PLAN 1. prepare lab 2. test exploit on xp 3. test 3 machines ssh with 3 linux 4. exploit xp via ssh 5. exploit win10 6. test ssh with win 10 7. exploit win10 via ssh 1. preparing lab using VBox (doesnt matter) i will create 4 machines, an arbitrary linux fo...