#Hack the Box

[bettermetalgoat]

Well I finally finished all the coursework for the hack the box CPTS thing. Now I just have to schedule the exam.

I am taking a well deserved break for the rest of the day.

[woted2]

Hack The Box: Tu Campo de Pruebas para Convertirte en un Maestro de la Ciberseguridad

¿Qué es Hack The Box? Hack The Box es una plataforma en línea que ofrece un entorno de aprendizaje gamificado para profesionales y entusiastas de la ciberseguridad. Fundada en 2017, su objetivo principal es proporcionar un espacio donde los usuarios puedan practicar hacking ético y resolver desafíos relacionados con la ciberseguridad. A diferencia de los métodos tradicionales de aprendizaje, HTB…

[ctfsec]

Owasp top 10 - parte 1

Hoje eu resolvi fazer o pacote owasp top 10 que está dentro do Tracks no hack the box. Para iniciar eu escolhi uma máquina com base na dificuldade, então a mais fácil parecia ser a sanitize.

1- Sanitize

Ao ligar vai instanciar a máquina e ao acessar o Ip, você verá uma tela de login:

Como não sabemos usuário nem nada, eu costumo colocar qualquer coisa só para ver o que acontece, nesse caso coloquei admin, admin, e retornou uma string sql:

Com isso ficou meio óbvio que é um sql injection.

Ao testar o mais padrão possível tivemos um erro:

ok, fui pesquisar um pouco sobre o sqlite3, e ao testar o Payload: ' or 1=1/* deu certo:

2- baby BoneChewerCon

Esse foi meio, meio, nada a dizer kk. Bom ao iniciar a instância você receberá um ip e porta, e ao acessar, teremos a seguinte página:

Ao digitar qualquer coisa e clicar no register me, teremos um erro:

E ao descer a página temos a flag:

É importante ler até o final.

3- Full Stack Conf

Ao acessar o ip e porta é engraçado que o nome é xss:

E temos a página:

Ao rodar a página até o final temos:

como ele fala, pop up an alert to get the flag, então ao colocar o payload: <script>alert("qualquercoisa")</script>

temos a flag:

Linkedin: Luana

htb: moominLua

[keferon]

So. I went online and bought this Transformers generations Blurr toy and holy shit nothing prepared me for the lore on the back of it’s box o_o

Also every time Blurr gets to be a sniper my soul ascends a little bit~

+ Bonus doodles

[glorbulus]

elderly citizen bullies children with insufferable pokemon team

[thatsbelievable]

[wisteriasymphony]

claudrien rules

CORRECT IT DOES anyway so out of reasons that were definitely not "fankid related spite" i wrote a fic where claudia has a medical emergency all alone and freaks adrien out oops! I drew some stuff out for it, I dunno. This is my gift to you for speaking the truth anon

[beanbagbuddies4life]

My big christmas present this year was a beanie I've wanted since like 2006: Loong or 龍 the dragon!

Loong uses the same pattern as the Zodiac Dragon, so here they are side by side.

These two were the ONLY toys made with this particular pattern. And they're both basically just named "Dragon."

Loong was an Asia-Pacific exclusive and has always been prohibitively expensive in the US.

I like the details like the texture on his muzzle, belly and paws.

It's surreal to hold him in my hands. Now I need to find a new bean to top my wishlist.

[atopvisenyashill]

as a follow up from their first hit single "it's racist to draw the starks vaguely brown" please welcome to the stage asoiaf xwitter with their latest, "it's racist to say that nettles isn't valyrian even though this is literally implied in the text"!!!!!!!!!

[redo-rewind-if]

Hi! So I just stumbled across this IF (SUPER interesting conceot btw i enjoyed it more than i expected!) and I scrolled through ur blog a bit but couldn't find anything related to this so-

If it wouldn't be too spoilery to answer, may I ask how MC and V's relationship would be perceived by the other staff at the office?

Like, do they keep it under wraps? Does everyone know anyway cause it's just so obvious? Do they know about the shift in the dynamics and does MC get teased about it?

Does MC get a bit of special treatment by chance shshehrh

I must know, dear author, so please deign to answer. For Science.

Not too spoilery at all! I actually love these sorts of asks! 😊

How MC's coworkers perceive their relationship would depend a bit on MC themself. But I think V, at least, would prefer to keep a romantic relationship with MC quiet and would likely try to avoid any special treatment.

As for how successful V actually is in those endeavors... well... honestly I think the whole office would be gossiping about their "office romance" within the week lmao. V is simply not nearly as subtle as they think they are in these matters.

And the whole "no special treatment" thing? Yeah, I give it a month tops. V is too weak to a romanced MC to completely manage the whole work/private life separation thing. 😅

Amara would likely be the first to catch on and would be an absolute menace about it. Especially for MCs she's close to, the teasing will be merciless and involve shitty gag gifts popping up on both their desks. Poor V is in for a time™.

[evamostly]

Life hack!

Put random things your cat likes (beads, pipe cleaners, whatever) into an empty tissue box, and enjoy watching your cat try to extract them!

[neural-blended]

[ctfsec]

Debugging Interface

DESCRIÇÃO DO DESAFIO

Acessamos a interface de depuração serial assíncrona do dispositivo embarcado enquanto ele estava operacional e capturamos algumas mensagens que estavam sendo transmitidas por ele. Você consegue decodificá-las?

Passos: Baixar os arquivos necessários:

Após baixar os arquivos, você vai extraílo, isso gerará uma pasta .sal, ao fazer uma pesquisa pois não conhecia esse tipo de arquivo, descobri que .sal é o formato de arquivo usado pelo software do Saleae Logic Analyzer. Baixei o software.

Para rodar, será preciso dar permissão de execução, então rodei: chmod a+x Logic-2.4.14-linux-x64.AppImage

./Logic-2.4.14-linux-x64.AppImage --no-sandbox

Com isso abriu a janela:

Aqui vamos arrastar o arquivo .sal que foi gerado após extrair o zip:

E ficará assim:

Precisamos dar zoom, é só segurar o ctrl e ficar clicando na parte preta, e ficará assim:

Na descrição do ctf está escrito: Acessamos a interface de depuração serial assíncrona. No Salae, se formos em add analyser, vemos que tem a opção async serial:

E teremos a seguinte janela:

Aqui, como queriamos descobrir o que estava escondido, coloquei o tamanho da onda, aquele numero que aparece na imagem 5, cliquei em analyzers e tcharam:

Pegamos a flag. Como hardware não é o meu forte, eu pesquisei alguns writeups após a conclusão pra ver se eu tinha seguido o caminho certo, e teve algumas diferenças haha, acho que por não manjar muito eu segui por uma lógica muito simples. Se quiserem ver outras soluções, recomendo o

Write-up diferente Mas foi isso. Obrigada pra quem leu e boa sorte a quem tentar.

Linkedin: Luana htb: moominLua

[jennamacaroni]

I loved how they didn't make Ruby a bad person or sth. She was actually cool and patient and could be a good partner for Ava, but as soon as D came into the picture (and before that if we're honest) Ava is like "mmm do i choose my perfectly good, patient, hot, cool girlfriend OR do i go for my toxic codependent fullfiling thrilling relationship with my decades older hot ex-boss who ghosted me?" and she's like "yep Deborah it is then" I love her

same here! ruby was actually the reasonable one all along. when ava comes back to LA at the end of s1 she notices that ava is different! calmer, happier, not spiraling, etc. she takes ava back because she actually is a better person (from working with deborah 🥲)! they move in together! shes even the one after avas dumb ass proposal to be like yo this person abuses you! shes slapped you, sued you, fired you, all these terrible horrible really bad things and not only do you excuse them, but you still go back to her when she asks!

i just imagine ruby either watching the post-oscars live late night ep (or seeing the viral clips on social media after) and being like—okay FINALLY deborah does something good and deserving of ava’s dedication. and then at the “who i love” bit shes just like oh yeah duh of course ava is in love with her, now looking back all those toxic moments make so much sense

im also really glad they had her apologize to ava after deborah made her talk about the proposal in her interview.

long live wolfgirl!

[thatsbelievable]

[sicklyseraphnsuch]

Imagine a being of absolute good just points at you and says, "You're the bad guys"