QR code had been use used in payments mostly nowadays, but the problem is that every QR code looks the same. If the malicious actor took over a website & updates their website’s QR code with a malicious QR code, the malicious actor would redirect the users that scan the…

We going to try out Hacksudo: 3 machine that’s created for the InfoSec Prep Discord Server. I would say that one of my favorite in this machine was the port knocking part. So let’s get start. Starting with Enumerations As we notice that this machine only has port 80 opened. We can’t find…

Crafting a Windows LNK with hotkey features => execute system command. Then, create a Microsoft office macro enabled document to utilize the malicious LNK to create a phishing environment. Today we will be trying on an interesting Windows LNK features which most of us might not be aware of “The…

Today, we will try out some TryHackMe OSINT challenge on a target named “Thomas Straussman” that’s suspected cheating on his wife. Story Before we start, let’s check out the scenario: Based on the background information, a mysterious person under the moniker “H” want us to investigate a suspected cheater “Thomas Straussman”. …

As we know that 99% of the machines in the corporate network they’re running Active Directory. So this article we will be doing a room from TryHackMe to practice on how can we exploit a vulnerable Domain Controller. Enumeration: Welcome to Attacktive Directory To start our penetration testing on Active Directory, the 1st phase we…

Perform pivoting into the internal network machine through SSH port forwarding to gain access to the internal network web server. Then, return a reverse shell from the internal network web server to our machine via SSH remote port forwarding. Explanation on the Network Topology Scenario In the network topology above, we can see that there’s 3…

VulnServer is useful for beginner which wants to learn how to find buffer overflow vulnerabilities & develop their own exploit script that able to abuse the buffer overflow vulnerability. …

In this article, we’ll be discussing an account takeover technique which use the HTTP host header attack to perform password reset poisoning. What is Password Reset Poisoning? Password reset poisoning is a technique which the attacker use to manipulate the vulnerable website password reset HTTP header to let the vulnerable website craft the reset password…

We can see that there’s a lot of IoT devices that is connected to the internet today. But most of the user did not notice that their IoT devices might have some vulnerable security issues. Most of the vendor will release patches to fix the security vulnerability of the IoT…