A Kubernetes cluster left partially exposed — a misconfigured node component allows unauthenticated command execution, and the resulting access is enough to spin up a privileged pod that reads the entire host filesystem.

Bind Shells With a bind shell, the target system has a listener started and awaits a connection from the attack system we can use Netcat to establish a bind shell 1234567# on…

A Linux machine hosting several internal services across subdomains — a vulnerable management tool hands over an initial foothold, and a misconfigured group permission opens the door to a straightforward Docker escape.

A Linux web machine built around font processing tools — leaking source code leads to credentials, and a chain of vulnerabilities in font libraries carries the attack from initial access all the way to root.

This module covers file transfer techniques leveraging tools commonly available across all versions of Windows and Linux systems.

A Linux machine running two vulnerable surveillance applications — a SQL injection in ZoneMinder leads to credentials, and an authenticated RCE in motionEye is leveraged to set a SUID bit and escalate to root.

This post is protected.

A classic retired Windows machine that chains anonymous FTP write access with an unpatched kernel vulnerability to achieve full system compromise.

This module equips learners with essential web reconnaissance skills, crucial for ethical hacking and penetration testing. It explores both active and passive techniques, including DNS enumeration, web crawling, analysis of web archives and HTTP headers, and fingerprinting web technologies.

Introinformation gathering using active (scans) and passive (use of third-party providers) methods. Enumeration Mythology Infrastructure Based EnumerationDomain Informationpassivel…