Info Security Memo
  • Blog
  • Sitemap
    • Categories
  • Contact
  • About
  • Resources
  • Tools
  • 51sec.org

Build Confidence

Focusing on Information Security 

Info Security Notes

Free 12 Months Google Gemini AI Pro (Bypass Student Verification)

12/6/2025

0 Comments

 

 This post shows you how to get this offer

  • University students get Google AI Pro at no cost for 1 year



Prep for your exams, perfect your writing, and tackle your homework with a free upgrade to the Google AI Pro plan giving you more access to Gemini app, NotebookLM, and Whisk plus 2TB of free storage

Pre-requisites


1. Google Account
2. Telegram Account (optional)
3. Paypal account or credit card, a virtual one works as well

Steps



1 Log into your google account


2 Go to https://one.google.com/ai to start apply


3 Use one of following methods to pass the verification of your student ID

3.1 Website : https://batch.1key.me/

3.2 Open Telegram to verify your student id

  • https://t.me/sheeridverifier_bot
  • https://t.me/auto_sheerid_bot?start=7661063113

4 verify the status



Videos

 
Quick & Easy Way to Get 1 Year Free Google AI Pro:





References



  • https://one.google.com/ai
  • https://batch.1key.me/



https://blog.51sec.org


Via http://blog.51sec.org/2025/12/free-12-months-google-gemini-ai-pro.html
0 Comments

Quick & Easy to Get 1 Year Free Google AI Pro

12/6/2025

0 Comments

 
Click to set custom HTML
0 Comments

Upgrade FreeRDP to 2.11.7dfsg1-6deb12u1 for Guacamole Installation on Debian 12

12/6/2025

0 Comments

 

Currently I have freerdp2-dev version 2.10.0+dfsg1-1 installed on Debian 12 (bookworm). There is a newer version available in the Debian 12 security and updates repositories: 2.11.7+dfsg1-6~deb12u1, which includes important fixes and improvements over 2.10.0.



The upstream FreeRDP project itself has much newer releases (such as 3.17.0 and even 3.19.0 as of December 2025). However, these are not yet packaged for Debian 12 and would require manual building if you need a cutting-edge version.
 

Background


For most users and for Apache Guacamole 1.6.0, Debian's 2.x series remains the best-supported choice, but you should upgrade to version 2.11.7+dfsg1-6~deb12u1 from the official package repositories for the latest bug and security fixes within Bookworm.



We can install 2.11.7+dfsg1-6~deb12u1 from Debian’s bookworm-proposed-updates (oldstable-proposed-updates) repository or directly from the .deb in the Debian pool, but both approaches are slightly “off the beaten path” and should be tested carefully on a non-production box first.


root@guacserverdeb12:~# dpkg -l | grep freerdp
ii  freerdp2-dev                         2.10.0+dfsg1-1                 amd64        Free Remote Desktop Protocol library (development files)
ii  libfreerdp-client2-2:amd64           2.10.0+dfsg1-1                 amd64        Free Remote Desktop Protocol library (client library)
ii  libfreerdp-server2-2:amd64           2.10.0+dfsg1-1                 amd64        Free Remote Desktop Protocol library (server library)
ii  libfreerdp-shadow-subsystem2-2:amd64 2.10.0+dfsg1-1                 amd64        FreeRDP Remote Desktop Protocol shadow subsystem libraries
ii  libfreerdp-shadow2-2:amd64           2.10.0+dfsg1-1                 amd64        FreeRDP Remote Desktop Protocol shadow libraries
ii  libfreerdp2-2:amd64                  2.10.0+dfsg1-1                 amd64        Free Remote Desktop Protocol library (core library)



Option 1: Enable proposed-updates (preferred Debian way)


  1. Edit APT sources to add proposed-updates for bookworm:

    • Open /etc/apt/sources.list in your editor (as root) and add a line like:
      deb http://deb.debian.org/debian bookworm-proposed-updates main.​

  2. Update package lists:

    • sudo apt update

  3. Install the specific version of the dev package (and runtime libraries will follow):

    • sudo apt install freerdp2-dev=2.11.7+dfsg1-6~deb12u1




root@guacserverdeb12:~# sudo apt install freerdp2-dev=2.11.7+dfsg1-6~deb12u1
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  libfreerdp-client2-2 libfreerdp-server2-2 libfreerdp-shadow-subsystem2-2 libfreerdp-shadow2-2 libfreerdp2-2 libwinpr-tools2-2 libwinpr2-2 libwinpr2-dev winpr-utils
Suggested packages:
  freerdp2-x11
The following packages will be upgraded:
  freerdp2-dev libfreerdp-client2-2 libfreerdp-server2-2 libfreerdp-shadow-subsystem2-2 libfreerdp-shadow2-2 libfreerdp2-2 libwinpr-tools2-2 libwinpr2-2 libwinpr2-dev winpr-utils
10 upgraded, 0 newly installed, 0 to remove and 11 not upgraded.
Need to get 1,821 kB of archives.
After this operation, 50.2 kB of additional disk space will be used.
Do you want to continue? [Y/n] Y



  1. To avoid pulling other proposed-updates automatically, you can pin this version in /etc/apt/preferences.d/freerdp2 with something like:

    
    
    text
    Package: freerdp2* libfreerdp* libwinpr* Pin: release n=bookworm-proposed-updates Pin-Priority: 1010
    
    

    This keeps the higher version available but limits what gets installed by default.

root@guacserverdeb12:~# dpkg -l | grep freerdp
ii  freerdp2-dev                         2.11.7+dfsg1-6~deb12u1         amd64        Free Remote Desktop Protocol library (development files)
ii  libfreerdp-client2-2:amd64           2.11.7+dfsg1-6~deb12u1         amd64        Free Remote Desktop Protocol library (client library)
ii  libfreerdp-server2-2:amd64           2.11.7+dfsg1-6~deb12u1         amd64        Free Remote Desktop Protocol library (server library)
ii  libfreerdp-shadow-subsystem2-2:amd64 2.11.7+dfsg1-6~deb12u1         amd64        FreeRDP Remote Desktop Protocol shadow subsystem libraries
ii  libfreerdp-shadow2-2:amd64           2.11.7+dfsg1-6~deb12u1         amd64        FreeRDP Remote Desktop Protocol shadow libraries
ii  libfreerdp2-2:amd64                  2.11.7+dfsg1-6~deb12u1         amd64        Free Remote Desktop Protocol library (core library)


Option 2: Install from the Debian pool (.deb files)


  1. Download the binaries for amd64 from the Debian pool directory, including at least freerdp2-dev_2.11.7+dfsg1-6~deb12u1_amd64.deb and its runtime dependencies such as libfreerdp2-2, libwinpr2-2, etc., from:

    • http://ftp.debian.org/debian/pool/main/f/freerdp2/.​

  2. Install with dpkg and fix dependencies with APT:

    • sudo dpkg -i freerdp2-*2.11.7+dfsg1-6~deb12u1_amd64.deb

    • sudo apt -f install
      This will pull any missing dependencies from your configured repositories where versions are compatible.





Compatibility and rollback notes


  • This version is targeted at bookworm as an oldstable-proposed-updates security/bugfix update, so ABI should remain compatible with packages built against 2.10.0, including Guacamole’s guacd on Debian 12.​

  • To revert, you can downgrade back to the archive version:

    • sudo apt install freerdp2-dev=2.10.0+dfsg1-1 and the matching library versions, or use apt install freerdp2-dev/bookworm to pull the default bookworm release.


Reference






https://blog.51sec.org


Via http://blog.51sec.org/2025/12/upgrade-freerdp-to-2117dfsg1-6deb12u1.html
0 Comments

Deploy Apache Guacamole 1.6.x on Debian 12 (Bookworm) (Tomcat9 MariaDB Guacd)

11/29/2025

0 Comments

 

This post summarizes the installation steps to install Guacamole on Debian 12.12. 




 

Download and Install Debian 12.12


https://archive.org/details/debian-12-bookworm-collection

debian-12.12.0-amd64-DVD-1.iso



Note: Debian 13 is having issue with Guacamole when using Remote APP which is caused by new release of freeRDP components on Debian 13. 


The Debian 12's installtion steps are similar as Debian 13, as show from these videos and posts: 
  • https://youtu.be/TxaVKYQGNPY
  • https://youtu.be/9nBqvl5Nwj0
  • https://blog.51sec.org/2025/10/debian-apt-update-error-issue.html


Configure Debian 12

root@debian12:~# cat /etc/issue
Debian GNU/Linux 12 \n \l

root@debian12:~# cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
root@debian12:~#

root@debian12:~# apt update
Ign:1 cdrom://[Debian GNU/Linux 12.12.0 _Bookworm_ - Official amd64 DVD Binary-1 with firmware 20250906-15:05] bookworm InRelease
Err:2 cdrom://[Debian GNU/Linux 12.12.0 _Bookworm_ - Official amd64 DVD Binary-1 with firmware 20250906-15:05] bookworm Release
  Please use apt-cdrom to make this CD-ROM recognized by APT. apt-get update cannot be used to add new CD-ROMs
Reading package lists... Done
E: The repository 'cdrom://[Debian GNU/Linux 12.12.0 _Bookworm_ - Official amd64 DVD Binary-1 with firmware 20250906-15:05] bookworm Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.


root@debian12:~# nano /etc/apt/sources.list
  GNU nano 7.2                                                                                     /etc/apt/sources.list
deb cdrom:[Debian GNU/Linux 12.12.0 _Bookworm_ - Official amd64 DVD Binary-1 with firmware 20250906-15:05]/ bookworm contrib main non-free-firmware

The error happens because your /etc/apt/sources.list is pointing only to the installation DVD (deb cdrom:). That line is useful during installation, but once the system is installed, you need to replace it with the official Debian network repositories so apt update can fetch packages online.

1. Change system apt source 

Edit the sources list  

Open the file: 

  • nano /etc/apt/sources.list 

Remove or comment out the CD-ROM line 

Put a # at the beginning of the deb cdrom: line, or delete it: 

  • # deb cdrom:[Debian GNU/Linux 12.12.0 Bookworm ...] 

Add the following six official Debian repositories 

  • deb http://deb.debian.org/debian bookworm main contrib non-free-firmware 
  • deb-src http://deb.debian.org/debian bookworm main contrib non-free-firmware 
  • deb http://security.debian.org/debian-security bookworm-security main contrib non-free-firmware 
  • deb-src http://security.debian.org/debian-security bookworm-security main contrib non-free-firmware 
  • deb http://deb.debian.org/debian bookworm-updates main contrib non-free-firmware 
  • deb-src http://deb.debian.org/debian bookworm-updates main contrib non-free-firmware 


Notes:

main → Free software contrib → Free software that depends on non-free non-free-firmware → Proprietary firmware (needed for Wi-Fi, GPUs, etc.)


Update package lists 

  • apt update –y && apt upgrade -y 


2. Change System IP


Three different solutions to change system Debian's IP address:
Situation Recommended method Key file/command
Desktop / default install NetworkManager nmcli connection modify ...​
Minimal server with ifupdown
(without desktop, not installed nmcli)
/etc/network/interfaces /etc/network/interfaces​
Clean server using systemd stack systemd-networkd /etc/systemd/network/*.network​

Find interface name
  • ip addr

Edit the interfaces file
  • nano /etc/network/interfaces

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug ens32
iface ens32 inet static
    address 192.168.2.196/24
    gateway 192.168.2.1
    dns-nameservers 8.8.8.8 8.8.4.4

Restart networking or reboot:
  • sudo systemctl restart networking
  • sudo reboot




Install Guacamole

https://guacamole.apache.org/doc/gug/guacamole-native.html

1. Change system apt source and upgrade system to latest 

Edit the sources list  

Open the file: 

  • nano /etc/apt/sources.list 

Remove or comment out the CD-ROM line 

Put a # at the beginning of the deb cdrom: line, or delete it: 

# deb cdrom:[Debian GNU/Linux 12.12.0 Bookworm ...] 

Add the official Debian repositories 

deb http://deb.debian.org/debian bookworm main contrib non-free-firmware 

deb-src http://deb.debian.org/debian bookworm main contrib non-free-firmware 

deb http://security.debian.org/debian-security bookworm-security main contrib non-free-firmware 

deb-src http://security.debian.org/debian-security bookworm-security main contrib non-free-firmware 

 deb http://deb.debian.org/debian bookworm-updates main contrib non-free-firmware 

deb-src http://deb.debian.org/debian bookworm-updates main contrib non-free-firmware 

 

Update package lists 

  • apt update –y && apt upgrade -y 

  • sudo apt update 

  • sudo apt full-upgrade -y 

  • sudo reboot 

 

Notes: 

Below steps will use official guide as reference: 

https://guacamole.apache.org/doc/gug/guacamole-native.html 

 

2. Install Required Dependencies 

 

sudo apt install -y build-essential libcairo2-dev libjpeg-turbo8-dev \ 

    libpng-dev libtool-bin libossp-uuid-dev libavcodec-dev libavformat-dev \ 

    libavutil-dev libwebsockets-dev freerdp2-dev libpango1.0-dev \ 

    libssh2-1-dev libtelnet-dev libvncserver-dev libssl-dev \ 

    libvorbis-dev libpulse-dev 

 

sudo apt install -y build-essential libcairo2-dev libjpeg62-turbo-dev \ 

    libpng-dev libtool-bin libossp-uuid-dev libavcodec-dev libavformat-dev \ 

    libavutil-dev libwebsockets-dev freerdp2-dev libpango1.0-dev \ 

    libssh2-1-dev libtelnet-dev libvncserver-dev libssl-dev \ 

    libvorbis-dev libpulse-dev 

 

sudo apt install -y build-essential libcairo2-dev libjpeg62-turbo-dev \ 

    libpng-dev libtool-bin libossp-uuid-dev libavcodec-dev libavformat-dev \ 

    libavutil-dev libswscale-dev libpango1.0-dev libssh2-1-dev libtelnet-dev \ 

    libvncserver-dev libpulse-dev libssl-dev libwebp-dev freerdp2-dev \ 

    libfreerdp2-2 ghostscript wget curl 

 

 

3. Install Java and Tomcat 

sudo apt install -y openjdk-11-jdk tomcat9 tomcat9-admin 

root@debian12:~# sudo apt install -y openjdk-11-jdk tomcat9 tomcat9-admin 

Reading package lists... Done 

Building dependency tree... Done 

Reading state information... Done 

Package tomcat9 is not available, but is referred to by another package. 

This may mean that the package is missing, has been obsoleted, or 

is only available from another source 

  

E: Unable to locate package openjdk-11-jdk 

E: Package 'tomcat9' has no installation candidate 

E: Unable to locate package tomcat9-admin 

 

 

Install Tomcat 9 from Debian 11 (Bullseye) repo 

  • sudo nano /etc/apt/sources.list 

  • deb http://deb.debian.org/debian bullseye main 

  • sudo apt update 

  • sudo apt install -t bullseye tomcat9 tomcat9-admin tomcat9-common 

 

After the installation, comment the bullseye repo out 

  • # deb http://deb.debian.org/debian bullseye main 

  • sudo apt update 

 

 

4. Install MySQL and Set Root Password 

Use MySQL secure installation: 

 

sudo apt install -y mysql-server mysql-client 

root@debian12:~# apt install -y mysql-server mysql-client 

Reading package lists... Done 

Building dependency tree... Done 

Reading state information... Done 

Package mysql-server is not available, but is referred to by another package. 

This may mean that the package is missing, has been obsoleted, or 

is only available from another source 

  

Package mysql-client is not available, but is referred to by another package. 

This may mean that the package is missing, has been obsoleted, or 

is only available from another source 

  

E: Package 'mysql-server' has no installation candidate 

E: Package 'mysql-client' has no installation candidate 

root@debian12:~# 

 

sudo apt install -y mariadb-server  

sudo mysql_secure_installation 

 

During the prompts: 

  • Set the MySQL root password (7x7IsNot48!) 

  • n to unix_socket authentication 

  • n to change the root password 

  • Y to Remove anonymous users 

  • Y to Disallow remote root login 

  • Y to Remove test database 

  • Y to Reload privileges 

 

sudo mysql 

 

ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY '7x7IsNot48!'; 

ALTER USER 'root'@'localhost' IDENTIFIED BY '7x7IsNot48!'; 

FLUSH PRIVILEGES; 

EXIT; 

 

 

5. Build and Install guacamole-server 

wget https://downloads.apache.org/guacamole/1.6.0/source/guacamole-server-1.6.0.tar.gz 

tar -xvzf guacamole-server-1.6.0.tar.gz 

cd guacamole-server-1.6.0 

./configure --with-init-dir=/etc/init.d 

make 

sudo make install 

sudo ldconfig 

 

 

6. Enable and Start guacd 

sudo systemctl enable guacd 

sudo systemctl start guacd 

sudo systemctl status guacd 

 

 

7. Deploy Guacamole Web App 

wget https://downloads.apache.org/guacamole/1.6.0/binary/guacamole-1.6.0.war 

sudo mv guacamole-1.6.0.war /var/lib/tomcat9/webapps/guacamole.war 

sudo systemctl restart tomcat9 

 

8. Set GUACAMOLE_HOME 

sudo mkdir -p /etc/guacamole/{extensions,lib} 

echo "GUACAMOLE_HOME=/etc/guacamole" | sudo tee -a /etc/default/tomcat9 

sudo systemctl restart tomcat9 

 

9. Install JDBC Authentication 

a. Download JDBC Extension 

wget https://downloads.apache.org/guacamole/1.6.0/binary/guacamole-auth-jdbc-1.6.0.tar.gz 

tar -xvzf guacamole-auth-jdbc-1.6.0.tar.gz 

sudo cp guacamole-auth-jdbc-1.6.0/mysql/guacamole-auth-jdbc-mysql-1.6.0.jar /etc/guacamole/extensions/ 

 

b. Install MySQL Connector/J 

wget https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-j-8.0.33.tar.gz 

tar -xvzf mysql-connector-j-8.0.33.tar.gz 

sudo cp mysql-connector-j-8.0.33/mysql-connector-j-8.0.33.jar /etc/guacamole/lib/ 

 

c. Create Database and Guacamole User 

Remember to change 'YourStrongPassword to an actual password. 

 

sudo mysql -u root -p 

Inside MySQL shell: 

CREATE DATABASE guacamole_db; 

CREATE USER 'guacamole_user'@'localhost' IDENTIFIED BY 'YourStrongPassword!'; 

GRANT SELECT,INSERT,UPDATE,DELETE ON guacamole_db.* TO 'guacamole_user'@'localhost'; 

FLUSH PRIVILEGES; 

EXIT; 

 

d. Import Guacamole Schema 

cat guacamole-auth-jdbc-1.6.0/mysql/schema/*.sql | sudo mysql -u root -p guacamole_db 

  • Use mysql root password to complete this step 

 

10. Configure guacamole.properties 

sudo nano /etc/guacamole/guacamole.properties 

It is empty file , please add: 

mysql-hostname: localhost 

mysql-port: 3306 

mysql-database: guacamole_db 

mysql-username: guacamole_user 

mysql-password: YourStrongPassword! 

 

Save and exit. 

 

11. Restart Services 

sudo systemctl restart tomcat9 guacd mysql 

 

12. Log In and Verify 

  • Open: http:// 172.16.0.6:8080/guacamole 

  • Default credentials: 

  • Username: guacadmin 

  • Password: guacadmin 

 Immediately change the password and create your own admin account. 


Configure Tomcat9 to Set Default Site to Guacamole site

 

13. Modify so http://localhost:8080 opens Guacamole 

sudo systemctl stop tomcat9 

sudo rm -rf /var/lib/tomcat9/webapps/ROOT 

sudo cp /var/lib/tomcat9/webapps/guacamole.war /var/lib/tomcat9/webapps/ROOT.war 

sudo systemctl start tomcat9 



Configure Guacamole.properties & user-mapping.xml

 

To define how Guacamole connects to guacd, create the guacamole.properties file under /etc/guacamole directory with the following content.

vim /etc/guacamole/guacamole.properties
guacd-hostname: localhost
guacd-port:     4822
user-mapping:   /etc/guacamole/user-mapping.xml
auth-provider:  net.sourceforge.guacamole.net.basic.BasicFileAuthenticationProvider

After that, save the configuration file and link the Guacamole configurations directory to Tomcat servlet directory as shown below.

ln -s /etc/guacamole /usr/share/tomcat9/.guacamole

Configure Guacamole Authentication Method

Guacamole’s default authentication method reads all users and connections from a single file called user-mapping.xml. In this file,you need to define the users allowed to access Guacamole web UI, the servers to connect to and the method of connection.

Therefore, run the command below to create this file with the following contents.

vim /etc/guacamole/user-mapping.xml

Be sure to replace password with your strong password.

<user-mapping>
        
    <!-- Per-user authentication and config information -->

    <!-- A user using md5 to hash the password
         guacadmin user and its md5 hashed password below is used to 
             login to Guacamole Web UI-->
    <authorize 
            username="guacadmin"
            password="5f4dcc3b5aa765d61d8327deb882cf99"
            encoding="md5">

        <!-- First authorized Remote connection -->
        <connection name="CentOS-Server">
            <protocol>ssh</protocol>
            <param name="hostname">192.168.56.156</param>
            <param name="port">22</param>
        </connection>

        <!-- Second authorized remote connection -->
        <connection name="Windows 7">
            <protocol>rdp</protocol>
            <param name="hostname">192.168.56.122</param>
            <param name="port">3389</param>
            <param name="username">netsec</param>
            <param name="ignore-cert">true</param>
        </connection>

    </authorize>

</user-mapping>

Generate the MD5 hash of passwords for the user used for logging into Guacamole web user interface. Replace you password accordingly;

echo -n password | openssl md5
printf '%s' password | md5sum

You should get following md5 value for your password string:

5f4dcc3b5aa765d61d8327deb882cf99

If you need to explicitly define usernames and passwords, add the parameters;

<param name="username">USERNAME</param>
<param name="password">PASSWORD</param>

Save and exit the configuration file.

You can check how to enable Guacamole OpenLDAP Authentication;

Setup Apache Guacamole OpenLDAP Authentication

Restart both Tomcat and guacd to effect the changes.

systemctl restart tomcat9 guacd

Be sure to check the syslog, /var/log/syslog or /var/log/tomcat9/CATALINA-* for any issues.




Videos

 








References


  • Deploy Apache Guacamole 1.6.x on Debian 12 (Bookworm) (Tomcat9, MariaDB, Guacd)
  • Configure Apache Guacamole To Use Database Authentication on Ununtu (Local DB or Free DB from Aiven.io)
  • Apache Guacamole Tips and Tricks
  • Deploy Guacamole Native Installation from Command Line (Ubuntu)
  • Using Portainer to Deploy Guacamole As Web Based Remote Access Gateway (Updated) & KASM Installation
  • Using Portainer and Docker to Deploy Guacamole Clientless Remote Desktop Gateway







https://blog.51sec.org


Via http://blog.51sec.org/2025/11/deploy-apache-guacamole-16x-on-debian.html
0 Comments

Free Online and Offline Labs From Pentester

11/28/2025

0 Comments

 

Here are some notes while working on those free labs from Pentester.




Free Offline Web Lab for Pentester


https://pentesterlab.com/exercises/web-for-pentester

Download ISO File 


Load into VM


Access the Portal based on the IP you got


Click on Examples on each category to start Lab

Here is Example 1 at XSS Category:



Security model of the web

The basis of the security model of the web is really simple: don't trust the client. Most information a server will receive can be spoofed by the client. Better to be safe than sorry; it's better to filter and escape everything than to realize later on that a value you thought was not user-controlled is.


XSS

Example 1:

Using the basic payload (<script>alert("Your Site is Hacked")</script>), you should be able to get an alert box.
  • http://192.168.2.186/xss/example1.php?name=<script>f</script> <input onfocus=f autofocus>
  • http://192.168.2.186/xss/example1.php?name=<script>alert("Your Site is Hacked")</script>
  • http://192.168.2.186/xss/example1.php?name=%3Cscript%3Ef%3C/script%3E%3Cinput%20onfocus=f%20autofocus%3E

Example 2:




Online Free Lab for Pentester


https://pentesterlab.com/my/progress#onlinefree






https://pentesterlab.com/exercises/recon-05

Fuzzing directories

When accessing a new webserver, it often pays off to brute force directories. To do this, you can use many tools like patator, FFUF or WFuzz (amongst many others).



wget https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/common.txt 



┌──(kali㉿kali)-[~]
└─$ gobuster dir -u http://hackycorp.com -w common.txt                                                                                                                                                                       
===============================================================
Gobuster v3.8
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://hackycorp.com
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.well-known/security.txt (Status: 200) [Size: 156]
/admin                (Status: 301) [Size: 178] [--> http://hackycorp.com/admin/]
/images               (Status: 301) [Size: 178] [--> http://hackycorp.com/images/]
/index.html           (Status: 200) [Size: 16011]
/robots.txt           (Status: 200) [Size: 121]
/startpage            (Status: 301) [Size: 178] [--> http://hackycorp.com/startpage/]
Progress: 4750 / 4750 (100.00%)
===============================================================
Finished
===============================================================


https://hackycorp.com/startpage/












Reference




  • https://pentesterlab.com/exercises/web-for-pentester



https://blog.51sec.org


Via http://blog.51sec.org/2025/11/free-online-and-offline-labs-from.html
0 Comments

Pen Test Labs Notes

11/28/2025

0 Comments

 

PentesterLab provides two free exercises every month. This post is to record some interesting ones I have been done. 

  • https://pentesterlab.com/exercises





 

API 18

In this challenge, your goal is to retrieve the key. However, the user you are logging in with does not have permission to access it. Your task is to identify a vulnerability in the authorization middleware. Upon logging in, you will see part of the application's source code. Audit the code carefully to uncover the vulnerability.



Burpsuite

Turn intercept on then open buit-in browser to open this page 

Click forward a couple of times until we got post 



Change post content by adding health=health, then forward 

You should be able to bypass the following check, which is checking if there is "health" at the end of url, and if the username is admin. If any of those condition not met, it will give you an error to show you dont have access to the key. 

    if !strings.HasSuffix(r.URL.String(), "health") && claims.Username != "admin" {
      http.Error(w, "You don't have access to the key", http.StatusUnauthorized)
      return
    }

Directory Traversal 01


Directory Traversals

Directory traversals come from a lack of filtering/encoding of information used as part of a path by an application.

As with other vulnerabilities, you can use the "same-value technique" to test for this type of issue.

For example, if the path used by the application inside a parameter is /images/photo.jpg. You can try to access:

  • /images/./photo.jpg: you should see the same file.
  • /images/../photo.jpg: you should get an error.
  • /images/../images/photo.jpg: you should see the same file again.
  • /images/../IMAGES/photo.jpg: you should get an error (depending on the file system), or something weird is going on.

If you don't have the value images and the legitimate path looks like photo.jpg, you will need to work out what the parent repository is.

Once you have tested that, you can try to retrieve other files.

On Linux/Unix the most common test case is the /etc/passwd.

You can test: images/../../../../../../../../../../../etc/passwd

If you get the passwd file, the application is vulnerable. The good news is that you don't need to know the number of ... If you put too many, it will still work.

Another interesting thing to know is that if you have a directory traversal in Windows, you will be able to access test/../../../file.txt, even if the directory test does not exist.

This is not the case on Linux.

This can be really useful where the code concatenates user-controlled data, to create a file name.

For example, the following PHP code is supposed to add the parameter id to get a file name (example_1.txt for example).

On Linux, you won't be able to exploit this vulnerability if there is no directory starting with example_, whereas on Windows, you will be able to exploit it, even if there is no such directory.

$file = "/var/files/example_".$_GET['id'].".txt";

In these exercises, the vulnerabilities are illustrated by a script used inside an <img tag.

You will need to read the HTML source (or use "Copy image URL") to find the correct link, and start exploiting the issue.

The first example is a really simple directory traversal. You just need to go up in the file system, and then back down, to get any files you want. In this instance, you will be restricted by the file system permissions, and won't be able to access /etc/shadow, for example.

In this example, based on the header sent by the server, your browser will display the content of the response. Sometimes the server will send the response with a header Content-Disposition: attachment, and your browser will not display the file directly. You can open the file to see the content. This method will take you some time for every test.

Using a Linux/Unix system, you can do this more quickly, by using wget or curl.

The objective of this exercise is to find the directory traversal and retrieve the key in the following file: /pentesterlab.key


For example, you find a file or image url is 
  • https://i.51sec.org/2025/chrome_fMjzra75Wa.png
You should be able to try to add . or .. into the url to go to other folders, but it will still show same result. 
  • https://i.51sec.org/././2025/chrome_fMjzra75Wa.png
  • https://i.51sec.org/../../../../../2025/chrome_fMjzra75Wa.png

If this vulnerability exists on the website, we should be able to construct a url like this to get the key:
  • https://i.51sec.org/../../../../../pentesterlab.key

In this exercise, you can use existing file.php to view this php file's content by right clicking page and viewing  source since it will show an empty page.

It is also possible to use a new constructed url to view /etc/passwd as show from following screenshot in Linux:
  • https://netsec.libcurl.me/file.php?file=../../../../../../../../../etc/passwd


On windows, you might be able to get the file boot.ini from c:/ drive. 


Videos

 



References






https://blog.51sec.org


Via http://blog.51sec.org/2025/11/pen-test-labs-notes.html
0 Comments

Vulnerability Remediation: 41028 SNMP Agent Default Community Name (public)

11/28/2025

0 Comments

 

The "SNMP Agent Default Community Name (public)" refers to a vulnerability and a specific Nessus plugin (ID 41028) that flags devices using the default public community string for Simple Network Management Protocol (SNMP). This is a security risk because attackers can easily guess public to gain unauthorized read access to network device information and potentially alter its configuration. To fix this, you must change the default community string to a strong, unique one on the device or, preferably, migrate to the more secure SNMPv3. 




 

Command to check SNMP services and ports


ps aux | grep snmp

systemctl status snmpd

sudo netstat -anu | grep 161

sudo ss -anu | grep 161





root@instance-webvm:~# apt install snmp
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  libsnmp-base libsnmp40t64
Suggested packages:
  snmp-mibs-downloader
The following NEW packages will be installed:
  libsnmp-base libsnmp40t64 snmp
0 upgraded, 3 newly installed, 0 to remove and 137 not upgraded.
Need to get 1452 kB of archives.
After this operation, 5221 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 http://us-central1.gce.archive.ubuntu.com/ubuntu noble-updates/main amd64 libsnmp-base all 5.9.4+dfsg-1.1ubuntu3.1 [206 kB]
Get:2 http://us-central1.gce.archive.ubuntu.com/ubuntu noble-updates/main amd64 libsnmp40t64 amd64 5.9.4+dfsg-1.1ubuntu3.1 [1066 kB]
Get:3 http://us-central1.gce.archive.ubuntu.com/ubuntu noble-updates/main amd64 snmp amd64 5.9.4+dfsg-1.1ubuntu3.1 [180 kB]
Fetched 1452 kB in 0s (11.8 MB/s)
Selecting previously unselected package libsnmp-base.
(Reading database ... 143395 files and directories currently installed.)
Preparing to unpack .../libsnmp-base_5.9.4+dfsg-1.1ubuntu3.1_all.deb ...
Unpacking libsnmp-base (5.9.4+dfsg-1.1ubuntu3.1) ...
Selecting previously unselected package libsnmp40t64:amd64.
Preparing to unpack .../libsnmp40t64_5.9.4+dfsg-1.1ubuntu3.1_amd64.deb ...
Unpacking libsnmp40t64:amd64 (5.9.4+dfsg-1.1ubuntu3.1) ...
Selecting previously unselected package snmp.
Preparing to unpack .../snmp_5.9.4+dfsg-1.1ubuntu3.1_amd64.deb ...
Unpacking snmp (5.9.4+dfsg-1.1ubuntu3.1) ...
Setting up libsnmp-base (5.9.4+dfsg-1.1ubuntu3.1) ...
Setting up libsnmp40t64:amd64 (5.9.4+dfsg-1.1ubuntu3.1) ...
Setting up snmp (5.9.4+dfsg-1.1ubuntu3.1) ...
Processing triggers for libc-bin (2.39-0ubuntu8.5) ...
Processing triggers for man-db (2.12.0-4build2) ...
Scanning processes...                                                                                                                                                                                                                             
Scanning candidates...                                                                                                                                                                                                                            
Scanning linux images...                                                                                                                                                                                                                          
Pending kernel upgrade!
Running kernel version:
  6.11.0-1017-gcp
Diagnostics:
  The currently running kernel version is not the expected kernel version 6.14.0-1012-gcp.
Restarting the system to load the new kernel will not be handled automatically, so you should consider rebooting.
Restarting services...
Service restarts being deferred:
 /etc/needrestart/restart.d/dbus.service
 systemctl restart docker.service
 systemctl restart [email protected]
 systemctl restart networkd-dispatcher.service
 systemctl restart [email protected]
 systemctl restart unattended-upgrades.service
No containers need to be restarted.
No user sessions are running outdated binaries.
No VM guests are running outdated hypervisor (qemu) binaries on this host.
root@instance-webvm:~# ss -anu | grep 161
root@instance-webvm:~# sudo netstat -anu | grep 161
sudo: netstat: command not found
root@instance-webvm:~# systemctl status snmpd
Unit snmpd.service could not be found.
root@instance-webvm:~# snmpwalk
Created directory: /var/lib/snmp/cert_indexes
No hostname specified.
USAGE: snmpwalk [OPTIONS] AGENT [OID]
  Version:  5.9.4.pre2
  Web:      http://www.net-snmp.org/
  Email:    [email protected]
OPTIONS:
  -h, --help            display this help message
  -H                    display configuration file directives understood
  -v 1|2c|3             specifies SNMP version to use
  -V, --version         display package version number
SNMP Version 1 or 2c specific
  -c COMMUNITY          set the community string
SNMP Version 3 specific
  -a PROTOCOL           set authentication protocol (MD5|SHA|SHA-224|SHA-256|SHA-384|SHA-512)
  -A PASSPHRASE         set authentication protocol pass phrase
  -e ENGINE-ID          set security engine ID (e.g. 800000020109840301)
  -E ENGINE-ID          set context engine ID (e.g. 800000020109840301)
  -l LEVEL              set security level (noAuthNoPriv|authNoPriv|authPriv)
  -n CONTEXT            set context name (e.g. bridge1)
  -u USER-NAME          set security name (e.g. bert)
  -x PROTOCOL           set privacy protocol (DES|AES|AES-192|AES-256)
  -X PASSPHRASE         set privacy protocol pass phrase
  -Z BOOTS,TIME         set destination engine boots/time
General communication options
  -r RETRIES            set the number of retries
  -t TIMEOUT            set the request timeout (in seconds)
Debugging
  -d                    dump input/output packets in hexadecimal
  -D[TOKEN[,...]]       turn on debugging output for the specified TOKENs
                           (ALL gives extremely verbose debugging output)
General options
  -m MIB[:...]          load given list of MIBs (ALL loads everything)
  -M DIR[:...]          look in given list of directories for MIBs
    (default: /root/.snmp/mibs:/usr/share/snmp/mibs:/usr/share/snmp/mibs/iana:/usr/share/snmp/mibs/ietf)
  -P MIBOPTS            Toggle various defaults controlling MIB parsing:
                          u:  allow the use of underlines in MIB symbols
                          c:  disallow the use of "--" to terminate comments
                          d:  save the DESCRIPTIONs of the MIB objects
                          e:  disable errors when MIB symbols conflict
                          w:  enable warnings when MIB symbols conflict
                          W:  enable detailed warnings when MIB symbols conflict
                          R:  replace MIB symbols from latest module
  -O OUTOPTS            Toggle various defaults controlling output display:
                          0:  print leading 0 for single-digit hex characters
                          a:  print all strings in ascii format
                          b:  do not break OID indexes down
                          e:  print enums numerically
                          E:  escape quotes in string indices
                          f:  print full OIDs on output
                          n:  print OIDs numerically
                          p PRECISION:  display floating point values with specified PRECISION (printf format string)
                          q:  quick print for easier parsing
                          Q:  quick print with equal-signs
                          s:  print only last symbolic element of OID
                          S:  print MIB module-id plus last element
                          t:  print timeticks unparsed as numeric integers
                          T:  print human-readable text along with hex strings
                          u:  print OIDs using UCD-style prefix suppression
                          U:  don't print units
                          v:  print values only (not OID = value)
                          x:  print all strings in hex format
                          X:  extended index format
  -I INOPTS             Toggle various defaults controlling input parsing:
                          b:  do best/regex matching to find a MIB node
                          h:  don't apply DISPLAY-HINTs
                          r:  do not check values for range/type legality
                          R:  do random access to OID labels
                          u:  top-level OIDs must have '.' prefix (UCD-style)
                          s SUFFIX:  Append all textual OIDs with SUFFIX before parsing
                          S PREFIX:  Prepend all textual OIDs with PREFIX before parsing
  -L LOGOPTS            Toggle various defaults controlling logging:
                          e:           log to standard error
                          o:           log to standard output
                          n:           don't log at all
                          f file:      log to the specified file
                          s facility:  log to syslog (via the specified facility)
                          (variants)
                          [EON] pri:   log to standard error, output or /dev/null for level 'pri' and above
                          [EON] p1-p2: log to standard error, output or /dev/null for levels 'p1' to 'p2'
                          [FS] pri token:    log to file/syslog for level 'pri' and above
                          [FS] p1-p2 token:  log to file/syslog for levels 'p1' to 'p2'
  -C APPOPTS            Set various application specific behaviours:
                          p:  print the number of variables found
                          i:  include given OID in the search range
                          I:  don't include the given OID, even if no results are returned
                          c:  do not check returned OIDs are increasing
                          t:  Display wall-clock time to complete the walk
                          T:  Display wall-clock time to complete each request
                          E {OID}:  End the walk at the specified OID






Using snmpwalk


For Linux –

$ snmpwalk -v1 -c public 192.168.8.1
$snmpwalk -v2c -c public 127.0.0.1

This uses SNMP v1 with the community string “public” and looks at the device with the IP address 192.168.8.1.

For Windows, that same query would be written as –

C:\Users\Laptop> snmpwalk -v:1 -r:192.168.8.1 -c:”public”

In that Windows version, you wouldn’t need to put in the -v:1 or -c:”public” parameters because these give the default values. So, if you missed those out, the command would use those values anyway.

Knowing that you are only going to get interesting information from a specific branch of the MIB tree, you can cut the scan short to skip directly to that part of the MIB.

On Linux, try:

$ snmpwalk -v1 -c public 192.168.8.1 .1.3.6.1.4.1.318

On Windows, you would type:

C:\Users\Laptop> snmpwalk -r:192.168.8.1 -os:.1.3.6.1.4.1.318

These two examples are for querying an APC device that has the IP address 192.168.8.1, so alter those numbers for your network.


Free SNMP Testing Tool

 

The Paessler Free SNMP Testing Tool is a good utility to use for checking on the community string on your network devices. This program runs on Windows and can be downloaded for free.

Run online snmpwalk in free Ubuntu online, free Fedora online, free Windows online emulator or free MACOS online emulator by OnWorks.
https://www.onworks.net/programs/snmpwalk-online


References







https://blog.51sec.org


Via http://blog.51sec.org/2025/11/vulnerability-remediation-41028-snmp.html
0 Comments

Security Principles

11/28/2025

0 Comments

 

Security has become a buzzword; every company wants to claim its product or service is secure. But is it? It is impossible to achieve perfect security; no solution is 100% secure. Therefore, we try to improve our security posture to make it more difficult for our adversaries to gain access.



 Note: https://tryhackme.com/room/securityprinciples

Free TryHackMe : https://tryhackme.com/resources/blog/free_path

CIA (Confidentiality, Integrity, Availability)


CIA triangle

Before we can describe something as secure, we need to consider better what makes up security. When you want to judge the security of a system, you need to think in terms of the security triad: confidentiality, integrity, and availability (CIA).

  • Confidentiality ensures that only the intended persons or recipients can access the data.
  • Integrity aims to ensure that the data cannot be altered; moreover, we can detect any alteration if it occurs.
  • Availability aims to ensure that the system or service is available when needed.

DAD (Disclosure, Alteration, Destruction / Denial)


DAD triangle

The security of a system is attacked through one of several means. It can be via the disclosure of secret data, alteration of data, or destruction of data.

  • Disclosure is the opposite of confidentiality. In other words, disclosure of confidential data would be an attack on confidentiality.
  • Alteration is the opposite of Integrity. For example, the integrity of a cheque is indispensable.
  • Destruction/Denial is the opposite of Availability.

The opposite of the CIA Triad would be the DAD Triad: Disclosure, Alteration, and Destruction.

Consider the previous example of patient records and related systems:

  • Disclosure: As in most modern countries, healthcare providers must maintain medical records’ confidentiality. As a result, if an attacker succeeds in stealing some of these medical records and dumping them online to be viewed publicly, the health care provider will incur a loss due to this data disclosure attack.
  • Alteration: Consider the gravity of the situation if the attacker manages to modify patient medical records. This alteration attack might lead to the wrong treatment being administered, and consequently, this alteration attack could be life-threatening.
  • Destruction/Denial: Consider the case where a medical facility has gone completely paperless. If an attacker manages to make the database systems unavailable, the facility will not be able to function properly. They can go back to paper temporarily; however, the patient records won’t be available. This denial attack would stall the whole facility.

Protecting against disclosure, alteration, and destruction/denial is of utter significance. This protection is equivalent to working to maintain confidentiality, integrity and availability.

Protecting confidentiality and integrity to an extreme can restrict availability, and increasing availability to an extreme can result in losing confidentiality and integrity. Good security principles implementation requires a balance between the three.


DiD ( Defence in Depth)

Defence-in-Depth refers to creating a security system of multiple levels; hence it is also called Multi-Level Security.

Consider the following analogy: you have a locked drawer where you keep your important documents and pricey stuff. The drawer is locked; however, do you want this drawer lock to be the only thing standing between a thief and your expensive items? If we think of multi-level security, we would prefer that the drawer be locked, the relevant room be locked, the main door of the apartment be locked, the building gate be locked, and you might even want to throw in a few security cameras along the way. Although these multiple levels of security cannot stop every thief, they would block most of them and slow down the others.



ISO/IEC 19249

ISO/IEC 19249:2017 Information technology - Security techniques - Catalogue of architectural and design principles for secure products, systems and applications

The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) have created the ISO/IEC 19249. The purpose is to have a better idea of what international organizations would teach regarding security principles.

ISO/IEC 19249 lists five architectural principles:

  1. Domain Separation: Every set of related components is grouped as a single entity; components can be applications, data, or other resources. Each entity will have its own domain and be assigned a common set of security attributes. For example, consider the x86 processor privilege levels: the operating system kernel can run in ring 0 (the most privileged level). In contrast, user-mode applications can run in ring 3 (the least privileged level). Domain separation is included in the Goguen-Meseguer Model.
  2. Layering: When a system is structured into many abstract levels or layers, it becomes possible to impose security policies at different levels; moreover, it would be feasible to validate the operation. Let’s consider the OSI (Open Systems Interconnection) model with its seven layers in networking. Each layer in the OSI model provides specific services to the layer above it. This layering makes it possible to impose security policies and easily validate that the system is working as intended. Another example from the programming world is disk operations; a programmer usually uses the disk read and write functions provided by the chosen high-level programming language. The programming language hides the low-level system calls and presents them as more user-friendly methods. Layering relates to Defence in Depth.
  3. Encapsulation: In object-oriented programming (OOP), we hide low-level implementations and prevent direct manipulation of the data in an object by providing specific methods for that purpose. For example, if you have a clock object, you would provide a method increment() instead of giving the user direct access to the seconds variable. The aim is to prevent invalid values for your variables. Similarly, in larger systems, you would use (or even design) a proper Application Programming Interface (API) that your application would use to access the database.
  4. Redundancy: This principle ensures availability and integrity. There are many examples related to redundancy. Consider the case of a hardware server with two built-in power supplies: if one power supply fails, the system continues to function. Consider a RAID 5 configuration with three drives: if one drive fails, data remains available using the remaining two drives. Moreover, if data is improperly changed on one of the disks, it would be detected via the parity, ensuring the data’s integrity.
  5. Virtualization: With the advent of cloud services, virtualization has become more common and popular. The concept of virtualization is sharing a single set of hardware among multiple operating systems. Virtualization provides sandboxing capabilities that improve security boundaries, secure detonation, and observance of malicious programs.

ISO/IEC 19249 teaches five design principles:

  1. Least Privilege: You can also phrase it informally as “need-to basis” or “need-to-know basis” as you answer the question, “who can access what?” The principle of least privilege teaches that you should provide the least amount of permissions for someone to carry out their task and nothing more. For example, if a user needs to be able to view a document, you should give them read rights without write rights.
  2. Attack Surface Minimisation: Every system has vulnerabilities that an attacker might use to compromise a system. Some vulnerabilities are known, while others are yet to be discovered. These vulnerabilities represent risks that we should aim to minimize. For example, in one of the steps to harden a Linux system, we would disable any service we don’t need.
  3. Centralized Parameter Validation: Many threats are due to the system receiving input, especially from users. Invalid inputs can be used to exploit vulnerabilities in the system, such as denial of service and remote code execution. Therefore, parameter validation is a necessary step to ensure the correct system state. Considering the number of parameters a system handles, the validation of the parameters should be centralized within one library or system.
  4. Centralized General Security Services: As a security principle, we should aim to centralize all security services. For example, we would create a centralized server for authentication. Of course, you might take proper measures to ensure availability and prevent creating a single point of failure.
  5. Preparing for Error and Exception Handling: Whenever we build a system, we should take into account that errors and exceptions do and will occur. For instance, in a shopping application, a customer might try to place an order for an out-of-stock item. A database might get overloaded and stop responding to a web application. This principle teaches that the systems should be designed to fail safe; for example, if a firewall crashes, it should block all traffic instead of allowing all traffic. Moreover, we should be careful that error messages don’t leak information that we consider confidential, such as dumping memory content that contains information related to other customers.

Zero Trust versus Trust but Verify


Trust is a very complex topic; in reality, we cannot function without trust. If one were to think that the laptop vendor has installed spyware on the laptop, they would most likely end up rebuilding the system. If one were to mistrust the hardware vendor, they would stop using it completely. If we think of trust on a business level, things only become more sophisticated; however, we need some guiding security principles. Two security principles that are of interest to us regarding trust:

  • Trust but Verify
  • Zero Trust

Trust but Verify: This principle teaches that we should always verify even when we trust an entity and its behaviour. An entity might be a user or a system. Verifying usually requires setting up proper logging mechanisms; verifying indicates going through the logs to ensure everything is normal. In reality, it is not feasible to verify everything; just think of the work it takes to review all the actions taken by a single entity, such as Internet pages browsed by a single user. This requires automated security mechanisms, such as proxy, intrusion detection, and intrusion prevention systems.

Zero Trust: This principle treats trust as a vulnerability, and consequently, it caters to insider-related threats. After considering trust as a vulnerability, zero trust tries to eliminate it. It is teaching indirectly, “never trust, always verify.” In other words, every entity is considered adversarial until proven otherwise. Zero trust does not grant trust to a device based on its location or ownership. This approach contrasts with older models that would trust internal networks or enterprise-owned devices. Authentication and authorization are required before accessing any resource. As a result, if any breach occurs, the damage would be more contained if a zero trust architecture had been implemented.

Microsegmentation is one of the implementations used for Zero Trust. It refers to the design where a network segment can be as small as a single host. Moreover, communication between segments requires authentication, access control list checks, and other security requirements.

There is a limit to how much we can apply zero trust without negatively impacting a business; however, this does not mean that we should not apply it as long as it is feasible.


Vulnerability vs Threat vs Risk

There are three terms that we need to take note of to avoid any confusion.

  • Vulnerability: Vulnerable means susceptible to attack or damage. In information security, a vulnerability is a weakness.
  • Threat: A threat is a potential danger associated with this weakness or vulnerability.
  • Risk: The risk is concerned with the likelihood of a threat actor exploiting a vulnerability and the consequent impact on the business.

Away from information systems, a showroom with doors and windows made of standard glass suffers a weakness, or vulnerability, due to the nature of glass. Consequently, there is a threat that the glass doors and windows can be broken. The showroom owners should contemplate the risk, i.e. the likelihood that a glass door or window gets broken and the resulting impact on the business.

Consider another example directly related to information systems. You work for a hospital that uses a particular database system to store all the medical records. One day, you are following the latest security news, and you learn that the used database system is not only vulnerable but also a proof-of-concept working exploit code has been released; the released exploit code indicates that the threat is real. With this knowledge, you must consider the resulting risk and decide the next steps.


Fundamental Concepts of Security Models



We have learned that the security triad is represented by Confidentiality, Integrity, and Availability (CIA). One might ask, how can we create a system that ensures one or more security functions? The answer would be in using security models. In this task, we will introduce three foundational security models:

  • Bell-LaPadula Model
  • The Biba Integrity Model
  • The Clark-Wilson Model

Bell-LaPadula Model

The Bell-LaPadula Model aims to achieve confidentiality by specifying three rules:

  • Simple Security Property : This property is referred to as “no read up”; it states that a subject at a lower security level cannot read an object at a higher security level. This rule prevents access to sensitive information above the authorized level.
  • Star Security Property : This property is referred to as “no write down”; it states that a subject at a higher security level cannot write to an object at a lower security level. This rule prevents the disclosure of sensitive information to a subject of lower security level.
  • Discretionary-Security Property : This property uses an access matrix to allow read and write operations. An example access matrix is shown in the table below and used in conjunction with the first two properties.
Subjects Object A Object B
Subject 1 Write No access
Subject 2 Read/Write Read

The first two properties can be summarized as “write up, read down.” You can share confidential information with people of higher security clearance (write up), and you can receive confidential information from people with lower security clearance (read down).

There are certain limitations to the Bell-LaPadula model. For example, it was not designed to handle file-sharing.

Biba Model

The Biba Model aims to achieve integrity by specifying two main rules:

  • Simple Integrity Property : This property is referred to as “no read down”; a higher integrity subject should not read from a lower integrity object.
  • Star Integrity Property : This property is referred to as “no write up”; a lower integrity subject should not write to a higher integrity object.

These two properties can be summarized as “read up, write down.” This rule is in contrast with the Bell-LaPadula Model, and this should not be surprising as one is concerned with confidentiality while the other is with integrity.

Biba Model suffers from various limitations. One example is that it does not handle internal threats (insider threat).

Clark-Wilson Model

The Clark-Wilson Model also aims to achieve integrity by using the following concepts:

  • Constrained Data Item (CDI) : This refers to the data type whose integrity we want to preserve.
  • Unconstrained Data Item (UDI) : This refers to all data types beyond CDI, such as user and system input.
  • Transformation Procedures (TPs) : These procedures are programmed operations, such as read and write, and should maintain the integrity of CDIs.
  • Integrity Verification Procedures (IVPs) : These procedures check and ensure the validity of CDIs.

We covered only three security models. The reader can explore many additional security models. Examples include:

  • Brewer and Nash model
  • Goguen-Meseguer model
  • Sutherland model
  • Graham-Denning model
  • Harrison-Ruzzo-Ullman model



Secure By Design






Examples of Secure By Design

 

Memory-safe programming languages
    not c & c++

Secure Hardware Foundation

Secure Software Components

Parametrized Queries

SBOMs

Vulnerability Disclosure Policies w/ Legal safe harbor

and more..




Secure By Default

 
  • Secure configuration out of the box
  • Manufacturer Responsibility
  • MFA-like push for security by default
  • "loosening guides", not "hardening guides"
  • no added costs or new licenses


Examples of Secure By Default
  • Eliminating default passwords
  • single sign-on at no additional cost
  • high-quality audit logs at no extra charge
  • reducing "hardening guide" size
  • security setting user experience



References



https://blog.51sec.org


Via http://blog.51sec.org/2025/11/security-principles.html
0 Comments

Azure Storage Studying Notes (RTO / RPO / SLA)

11/28/2025

0 Comments

 
Click to set custom HTML
0 Comments

Penetration Testing Methodologies from Tryhackme

11/28/2025

0 Comments

 

This post collects some studying notes while browsing through https://tryhackme.com/





Penetration Testing Methodologies




Penetration tests can have a wide variety of objectives and targets within scope. Because of this, no penetration test is the same, and there are no one-case fits all as to how a penetration tester should approach it.

The steps a penetration tester takes during an engagement is known as the methodology. A practical methodology is a smart one, where the steps taken are relevant to the situation at hand. For example, having a methodology that you would use to test the security of a web application is not practical when you have to test the security of a network.




Before discussing some different industry-standard methodologies, we should note that all of them have a general theme of the following stages:


Stage Description
Information Gathering

This stage involves collecting as much publically accessible information about a target/organisation as possible, for example, OSINT and research.

Note: This does not involve scanning any systems.

Enumeration/Scanning This stage involves discovering applications and services running on the systems. For example, finding a web server that may be potentially vulnerable.
Exploitation This stage involves leveraging vulnerabilities discovered on a system or application. This stage can involve the use of public exploits or exploiting application logic.
Privilege Escalation Once you have successfully exploited a system or application (known as a foothold), this stage is the attempt to expand your access to a system. You can escalate horizontally and vertically, where horizontally is accessing another account of the same permission group (i.e. another user), whereas vertically is that of another permission group (i.e. an administrator).
Post-exploitation

This stage involves a few sub-stages:

1. What other hosts can be targeted (pivoting)

2. What additional information can we gather from the host now that we are a privileged user

3.  Covering your tracks

4. Reporting



OSSTMM


The Open Source Security Testing Methodology Manual provides a 
detailed framework of testing strategies for systems, software, applications, communications and the human aspect of cybersecurity.
The methodology focuses primarily on how these systems, applications communicate, so it includes a methodology for:

  1. Telecommunications (phones, VoIP, etc.)
  2. Wired Networks
  3. Wireless communications


Advantages Disadvantages
Covers various testing strategies in-depth.
The framework is difficult to understand, very detailed, and tends to use unique definitions.
Includes testing strategies for specific targets (I.e. telecommunications and networking) 
Intentionally left blank.
The framework is flexible depending upon the organisation's needs.
Intentionally left blank.
The framework is meant to set a standard for systems and applications, meaning that a universal methodology can be used in a penetration testing scenario.
Intentionally left blank.


OWASP


The "Open Web Application Security Project" framework is a community-driven and frequently updated framework used solely to test the security of web applications and services.


The foundation regularly writes reports stating the top ten security vulnerabilities a web application may have, the testing approach, and remediation.


Advantages Disadvantages
Easy to pick up and understand. It may not be clear what type of vulnerability a web application has (they can often overlap).
Actively maintained and is frequently updated.
OWASP does not make suggestions to any specific software development life cycles.
It covers all stages of an engagement: from testing to reporting and remediation.
The framework doesn't hold any accreditation such as CHECK.
Specialises in web applications and services.
Intentionally left blank.



NIST Cybersecurity Framework 1.1


The NIST Cybersecurity Framework is a popular framework used to improve an organisations cybersecurity standards and manage the risk of cyber threats. This framework is a bit of an honourable mention because of its popularity and detail.


The framework provides guidelines on security controls & benchmarks for success for organisations from critical infrastructure (power plants, etc.) all through to commercial.  There is a limited section on a standard guideline for the methodology a penetration tester should take.



Advantages Disadvantages
The NIST Framework is estimated to be used by 50% of American organisations by 2020.
NIST has many iterations of frameworks, so it may be difficult to decide which one applies to your organisation.
The framework is extremely detailed in setting standards to help organisations mitigate the threat posed by cyber threats.
The NIST framework has weak auditing policies, making it difficult to determine how a breach occurred.
The framework is very frequently updated.
The framework does not consider cloud computing, which is quickly becoming increasingly popular for organisations.
NIST provides accreditation for organisations that use this framework.
Intentionally left blank.
The NIST framework is designed to be implemented alongside other frameworks.
Intentionally left blank.


NCSC CAF


The Cyber Assessment Framework (CAF) is an extensive framework of fourteen principles used to assess the risk of various cyber threats and an organisation's defences against these.


The framework applies to organisations considered to perform "vitally important services and activities" such as critical infrastructure, banking, and the likes. The framework mainly focuses on and assesses the following topics:

  • Data security
  • System security
  • Identity and access control
  • Resiliency
  • Monitoring
  • Response and recovery planning


Advantages Disadvantages
This framework is backed by a government cybersecurity agency.
The framework is still new in the industry, meaning that organisations haven't had much time to make the necessary changes to be suitable for it.
This framework provides accreditation.
The framework is based on principles and ideas and isn't as direct as having rules like some other frameworks.
This framework covers fourteen principles which range from security to response.
Intentionally left blank.


 

Gobuster  command to brute-force website pages


Most companies have an admin portal page, giving their staff access to basic admin controls for day-to-day operations. For a bank, an employee might need to transfer money to and from client accounts. Due to human error or negligence, there may be instances when these pages are not made private, allowing attackers to find hidden pages that show or give access to admin controls or sensitive data.

To begin, type the following command into the terminal to find potentially hidden pages on FakeBank's website using Gobuster (a command-line security application).

gobuster -u http://fakebank.thm -w wordlist.txt dir

The command will run and show you an output similar to this:

Gobustercommand to brute-force website pages
ubuntu@tryhackme:~/Desktop$ gobuster -u http://fakebank.thm -w wordlist.txt dir

=====================================================
Gobuster v2.0.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dir
[+] Url/Domain   : http://fakebank.thm/
[+] Threads      : 10
[+] Wordlist     : wordlist.txt
[+] Status codes : 200,204,301,302,307,403
[+] Timeout      : 10s
=====================================================
2024/05/21 10:04:38 Starting gobuster
=====================================================
/images (Status: 301)
/bank-transfer (Status: 200)
=====================================================
2024/05/21 10:04:44 Finished
=====================================================

In the command above, -u is used to state the website we're scanning, -w takes a list of words to iterate through to find hidden pages.

You will see that Gobuster scans the website with each word in the list, finding pages that exist on the site. Gobuster will have told you the pages in the list of page/directory names (indicated by Status: 200).

Screenshot showing Gobuster output





How to Get Wordlist




Open-Source DB for Threat Intelligence


  • AbuseIPDB - https://www.abuseipdb.com/
  • Cisco Talos Intelligence - https://www.talosintelligence.com/
  • VirusTotal - virustotal.com/gui/





References


  • https://www.securitymagazine.com/ - Security Magazine

https://blog.51sec.org


Via http://blog.51sec.org/2025/11/penetration-testing-methodologies-from.html
0 Comments
<<Previous

    Categories

    All
    Architecture
    Blog
    Checkpoint
    Cisco
    Cloud
    CyberArk
    F5
    Fortigate
    Guardium
    Juniper
    Linux
    Network
    Others
    Palo Alto
    Qualys
    Raspberry Pi
    Security
    SIEM
    Software
    Vmware
    VPN
    Wireless

    Archives

    March 2024
    February 2024
    January 2024
    December 2023
    November 2023
    October 2023
    September 2023
    August 2023
    July 2023
    June 2023
    May 2023
    April 2023
    March 2023
    February 2023
    January 2023
    December 2022
    November 2022
    October 2022
    September 2022
    August 2022
    July 2022
    June 2022
    May 2022
    April 2022
    March 2022
    February 2022
    January 2022
    December 2021
    November 2021
    October 2021
    September 2021
    August 2021
    July 2021
    June 2021
    May 2021
    April 2021
    March 2021
    February 2021
    January 2021
    December 2020
    November 2020
    October 2020
    September 2020
    August 2020
    July 2020
    October 2019
    September 2019
    June 2019
    July 2018
    May 2018
    December 2017
    August 2017
    April 2017
    March 2017
    January 2017
    December 2016
    November 2016
    October 2016
    September 2016
    August 2016
    July 2016
    June 2016
    May 2016
    April 2016
    March 2016
    February 2016
    January 2016
    December 2015
    November 2015
    October 2015
    September 2015
    August 2015
    July 2015
    June 2015
    May 2015
    April 2015
    March 2015

    Print Page:

    RSS Feed

    Email Subscribe
Powered by Create your own unique website with customizable templates.
  • Blog
  • Sitemap
    • Categories
  • Contact
  • About
  • Resources
  • Tools
  • 51sec.org